Cloudanix VulnDB

CVE-2026-90333

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux storage protection feature could let someone with direct disk access fake deleted data blocks and slip in changes without being noticed.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The discard-block check in dm_integrity_rw_tag() accepts an all-0xf6 DISCARD_FILLER tag as proof a block was discarded and skips HMAC verification, allowing forgery by any party with raw write access to the backing device.

Why it matters to the business

Attackers can silently corrupt or replace data on integrity-protected storage volumes without detection, undermining the confidentiality and integrity guarantees of dm-integrity deployments used for sensitive or encrypted data.

How an attack unfolds

An attacker who obtains raw write access to the underlying block device (but lacks the integrity key) overwrites selected sector tags with the constant 0xf6 pattern; on subsequent reads the kernel treats the blocks as legitimately discarded, skips authentication, and returns attacker-controlled or stale data as authentic.

How to fix it

Upgrade the Linux kernel to a version containing the dm-integrity keyed discard fix, replace any use of the allow_discards target argument with allow_discards_keyed, and ensure integrity_discard_checksum() is active for all discard-enabled volumes.

How to confirm the fix worked

Inspect active dm-integrity targets for the presence of allow_discards_keyed, verify kernel source or binary contains integrity_discard_checksum(), and confirm that HMAC verification occurs on all non-discard reads.

Typical attack path

  1. Gain raw write access to the dm-integrity backing device
  2. Locate target sectors protected by dm-integrity
  3. Overwrite the per-sector tags with the DISCARD_FILLER value 0xf6
  4. Trigger or wait for read operations that invoke dm_integrity_rw_tag()
  5. Receive forged data that bypasses HMAC verification

How to detect it

Review kernel and device-mapper logs for unexpected discard operations on integrity devices, correlate with raw block-device writes from untrusted processes, and inspect backing-device access patterns that coincide with integrity tag modifications.

What your security team should do

  • Audit all dm-integrity device-mapper tables for allow_discards usage
  • Migrate configurations to allow_discards_keyed or disable discards where feasible
  • Restrict raw device access via mandatory access controls and monitoring
  • Prioritize patching on systems handling sensitive or high-value data

The record

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and skips HMAC verification. allow_discards is only accepted in dm-integrity's standalone mode. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with an all-0xf6 tag and have it served as authentic. Add a new "allow_discards_keyed" target argument that marks discarded blocks with a keyed checksum of (salt || sector) instead, computed by integrity_discard_checksum().

Affected packages

Ecosystem Package Introduced Fixed