Live › vulnerability › CVE-2026-98533
Go to dashboardThe Linux kernel's IPE (Integrity Policy Enforcement) module can free an old dm-verity root hash while policy evaluation is still reading it, a use-after-free race. The sources do not say what an attacker gains from it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with IPE enabled and dm-verity-backed block devices used with IPE integrity policies are the relevant ones. The sources do not say which kernel versions are affected or how common the configuration is.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ipe: protect the dm-verity root hash with RCU
ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it.
Protect the root hash with RCU. The evaluation path already runs under rcu_read_lock().
[FW: remove model name according to latest guideline]
This page as .md · .json · in your agent: get_signal("CVE-2026-98533")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.