Cloudanix VulnDB

CVE-2026-99087

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux storage integrity checking can crash the whole system when certain read-only volumes are started, and the fix is to install the latest kernel update.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

NULL pointer dereference in dm_integrity_resume triggered when a dm-integrity device with SB_FLAG_DIRTY_BITMAP set is activated in read-only 'R' mode, causing an attempt to access a non-existent journal bitmap.

Why it matters to the business

Kernel crash or denial-of-service on systems that use device-mapper integrity targets with dirty-bitmap journaling when administrators or scripts activate volumes in read-only mode.

How an attack unfolds

An attacker with the ability to trigger dm-integrity device activation (local user, initramfs script, or automated storage stack) supplies or manipulates a device that has the dirty-bitmap superblock flag set and requests 'R' mode activation, causing the resume path to dereference a NULL journal pointer.

How to fix it

Apply the upstream patch that adds an early return in dm_integrity_resume when the device is in read-only mode; rebuild and boot a fixed kernel. Until a patched kernel is available, avoid activating dm-integrity devices that carry the dirty-bitmap flag in 'R' mode.

How to confirm the fix worked

Boot the patched kernel, activate a test dm-integrity device that has SB_FLAG_DIRTY_BITMAP set using the 'R' flag, and confirm the device resumes without an oops or NULL dereference in dm_integrity_resume.

Typical attack path

  1. Obtain local execution or control over storage activation (user, container, or boot script)
  2. Present or modify a dm-integrity target whose superblock carries SB_FLAG_DIRTY_BITMAP
  3. Activate the target using the 'R' (read-only) flag
  4. dm_integrity_resume attempts journal bitmap access and dereferences NULL, crashing the kernel

How to detect it

Search kernel logs (dmesg, journalctl) for oops or panic entries containing dm_integrity_resume or NULL pointer dereference shortly after dm-integrity device activation; look for preceding messages that mention SB_FLAG_DIRTY_BITMAP or journal bitmap.

What your security team should do

  • Prioritize kernel updates for any distribution or custom build that includes dm-integrity
  • Audit storage initialization scripts and container runtimes for read-only activation of integrity devices
  • Monitor kernel logs for oops messages referencing dm_integrity_resume after any storage stack changes

The record

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm_integrity_resume happens because the function attempts to read the journal containing the bitmap. This patch makes dm-integrity skip any writes to the device in dm_integrity_resume if the device is activated in the 'R' mode.

Affected packages

Ecosystem Package Introduced Fixed