Cloudanix VulnDB

CVE-2026-99135

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's data integrity feature can cause the system to freeze when performing certain disk operations if a large security tag size is used.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A flaw in dm-integrity's handling of discard operations causes an infinite loop when the integrity tag size exceeds HASH_MAX_DIGESTSIZE and a kmalloc failure occurs, because max_blocks becomes zero and bi_size is never decremented.

Why it matters to the business

Systems using dm-integrity with large tag sizes may experience kernel hangs or high CPU usage during discard operations, potentially leading to denial of service and requiring manual intervention to recover.

How an attack unfolds

An attacker with the ability to trigger discard operations on a dm-integrity device configured with a tag size larger than HASH_MAX_DIGESTSIZE can cause the kernel to enter an infinite loop by inducing a kmalloc failure in the integrity_metadata discard handler.

How to fix it

Update the Linux kernel to a version containing the fix for this issue. The patch uses sizeof(checksums_onstack) as max_size to ensure max_blocks is at least 1.

How to confirm the fix worked

Verify the presence of the commit that sets max_size to sizeof(checksums_onstack) in the dm-integrity code. Test discard operations with large tag sizes under memory pressure.

Typical attack path

  1. Configure or identify a dm-integrity target with tag size > HASH_MAX_DIGESTSIZE
  2. Trigger discard I/O operations on the device
  3. Induce memory allocation failure for the tag buffer
  4. Observe infinite loop in kernel thread processing the discard

How to detect it

Look for kernel logs indicating infinite loops or high CPU in dm-integrity code paths, or processes stuck in discard handling. Check for repeated calls to integrity_metadata without progress.

What your security team should do

  • Apply kernel updates containing the dm-integrity fix as soon as available
  • Monitor for kernel hangs associated with device-mapper integrity targets
  • Review dm-integrity configurations for tag sizes exceeding typical digest sizes

The record

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the tags, max_blocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the tag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size is never decremented and the loop never terminates. Fix this by using sizeof(checksums_onstack) as max_size. The array has MAX_TAG_SIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so max_blocks is at least 1.

Affected packages

Ecosystem Package Introduced Fixed