CVE-2026-98533
Received Received - Intake

Linux Kernel dm-verity Root Hash Race Condition

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. The evaluation path already runs under rcu_read_lock(). [FW: remove model name according to latest guideline]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98533
EUVD
EUVD-2026-103578

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux e155858dd99523d4afe0f74e9c26e4f4499eb5af
Linux Linux e155858dd99523d4afe0f74e9c26e4f4499eb5af
Linux Linux e155858dd99523d4afe0f74e9c26e4f4499eb5af
Linux Linux e155858dd99523d4afe0f74e9c26e4f4499eb5af
Linux Linux 6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a race condition in the Linux kernel's IPE (Integrity Policy Enforcement) module when handling dm-verity root hashes. The issue occurs when ipe_bdev_setintegrity() frees an old root hash while policy evaluation is still accessing it, potentially leading to use-after-free or memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPE (Integrity Policy Enforcement) and dm-verity components. Detection requires checking kernel logs for related errors or kernel crashes during dm-verity operations. Commands like dmesg | grep -i ipe or journalctl -k | grep -i dm-verity may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to cause a kernel crash or execute arbitrary code with elevated privileges by exploiting the race condition during dm-verity hash updates. This may lead to system instability or unauthorized access.

Compliance Impact

This vulnerability involves a race condition in the Linux kernel's dm-verity integrity protection mechanism, where the root hash could be freed while still in use. This could lead to integrity checks failing or policy violations, potentially compromising data integrity.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ipe and dm-verity root hash vulnerability. Monitor kernel security advisories for patches and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98533. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart