Cloudanix VulnDB

CVE-2026-99098

None

CVSS

—

EPSS

0.2%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Linux storage integrity feature can crash the whole system during normal reads if it uses very large checksum tags, but only someone already in control can trigger it.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Stack buffer overflow in dm_integrity_check and dm_integrity_inline_recheck when tag size exceeds HASH_MAX_DIGESTSIZE during checksum computation and zero-padding in inline mode.

Why it matters to the business

Systems using dm-integrity with unusually large tag sizes may experience kernel panics on read operations, leading to downtime; the issue requires root access to trigger and does not enable privilege escalation.

How an attack unfolds

An attacker with root privileges configures a dm-integrity device using inline mode and a tag size larger than HASH_MAX_DIGESTSIZE, then triggers checksum calculations via reads to overflow the on-stack buffer.

How to fix it

Apply the kernel fix that enlarges the checksum buffers to MAX_TAG_SIZE bytes in dm-integrity inline handling; rebuild and deploy updated kernels to affected systems.

How to confirm the fix worked

Verify kernel source includes the buffer size change to MAX_TAG_SIZE; test dm-integrity setups with tag sizes exceeding HASH_MAX_DIGESTSIZE to confirm absence of overflow or panic.

Typical attack path

  1. Obtain root access on the target system
  2. Create or modify a dm-integrity mapping in inline mode with tag size > HASH_MAX_DIGESTSIZE
  3. Perform I/O operations that invoke dm_integrity_check or dm_integrity_inline_recheck
  4. Trigger stack overflow leading to panic under CONFIG_STACKPROTECTOR

How to detect it

Review kernel logs for stack protector panics originating from dm_integrity_check or dm_integrity_inline_recheck functions during block reads on integrity devices.

What your security team should do

  • Patch dm-integrity kernel code immediately on systems using large integrity tags
  • Audit dm-integrity configurations for tag sizes larger than HASH_MAX_DIGESTSIZE
  • Monitor for kernel panics during integrity checks as a stability indicator

The record

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read. Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.

Affected packages

Ecosystem Package Introduced Fixed