CVE-2026-98533

What it actually does

Use-after-free in ipe_bdev_setintegrity allowing concurrent policy evaluation to dereference a freed dm-verity root hash pointer.

Why it matters to the business

Potential kernel memory corruption on systems using IPE with dm-verity, which could lead to crashes, denial of service, or local privilege escalation; low public exploitability but still requires prompt kernel updates.

How an attack unfolds

An attacker with local access triggers a dm-verity resume that frees the root hash while a concurrent IPE policy evaluation under RCU still holds a reference, resulting in a use-after-free access.

How to fix it

Apply the kernel patch that wraps the root hash with RCU and ensures ipe_bdev_setintegrity respects RCU semantics; rebuild and reboot to the fixed kernel version.

How to confirm the fix worked

Confirm the patch is present by inspecting the ipe source for RCU-protected root hash handling and verify the rcu_read_lock is held during evaluation; test by exercising dm-verity resume paths under load.

Typical attack path

1. Obtain local code execution on a target system using IPE and dm-verity
2. Trigger repeated dm-verity ->preresume operations while IPE policy evaluation is active
3. Cause the freed root hash pointer to be dereferenced to achieve memory corruption or information leak

How to detect it

Review kernel logs for oops or warnings referencing ipe or dm-verity root hash access; look for unusual process crashes correlated with dm-verity volume operations.

What your security team should do

• Prioritize kernel updates on all systems using IPE with dm-verity within standard patch windows
• Monitor for any future EPSS increase or public exploit code
• Review IPE policies to ensure they are not overly permissive while the fix is deployed