CVE-2026-99098
Received Received - Intake

Buffer Overflow in Linux Kernel dm-integrity

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read. Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-99098
EUVD
EUVD-2026-109904

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux fb0987682c629c1d2c476f35f6fde405a5e304a4
Linux Linux fb0987682c629c1d2c476f35f6fde405a5e304a4
Linux Linux fb0987682c629c1d2c476f35f6fde405a5e304a4
Linux Linux fb0987682c629c1d2c476f35f6fde405a5e304a4
Linux Linux 6.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's device-mapper integrity target (dm-integrity) when operating in inline mode with large tag sizes. The issue occurs because checksum buffers are too small to handle large tag sizes, causing memory corruption when padding results. This triggers a kernel panic under certain configurations like CONFIG_STACKPROTECTOR.

Detection Guidance

This vulnerability is specific to the Linux kernel's dm-integrity module and requires root access to trigger. Detection involves checking the kernel version and dm-integrity configuration. Use 'uname -r' to check the kernel version and 'lsmod | grep dm_integrity' to verify if the module is loaded.

Impact Analysis

The vulnerability can cause system crashes (kernel panics) when reading data from dm-integrity devices with large tag sizes. However, exploitation requires root privileges, limiting its practical impact to local attackers with elevated permissions.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Monitor kernel security advisories and apply updates promptly. If using dm-integrity with large tag sizes, ensure the module is not loaded or restrict root access to prevent triggering the bug.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99098. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart