{"id":"CVE-2026-98533","kind":"vulnerability","aliases":["CVE-2026-98533"],"related":[],"title":"Linux kernel: IPE dm-verity root hash freed while still in use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipe: protect the dm-verity root hash with RCU\n\nipe_bdev_setintegrity() frees the old root hash when dm-verity publishes\na new one on ->preresume, while policy evaluation can still be\ndereferencing it.\n\nProtect the root hash with RCU. The evaluation path already runs under\nrcu_read_lock().\n\n[FW: remove model name according to latest guideline]","summary":"The Linux kernel's IPE (Integrity Policy Enforcement) module can free an old dm-verity root hash while policy evaluation is still reading it, a use-after-free race. The sources do not say what an attacker gains from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dm-verity","infrastructure","ipe","linux-kernel","self-hosted"],"not_affected_if":["ipe-disabled"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98533 (version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:50+00:00","updated_at":"2026-10-25T05:23:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-98533 (version unknown from the sources)","reach":"local","title":"Linux kernel: IPE dm-verity root hash freed while still in use","impact":"medium","summary":"The Linux kernel's IPE (Integrity Policy Enforcement) module can free an old dm-verity root hash while policy evaluation is still reading it, a use-after-free race. The sources do not say what an attacker gains from it.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","ipe","dm-verity"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; a race on freed memory in the kernel","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, fixed versions and the real impact of the use-after-free.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["ipe-disabled"],"who_is_affected":"Systems running a Linux kernel with IPE enabled and dm-verity-backed block devices used with IPE integrity policies are the relevant ones. The sources do not say which kernel versions are affected or how common the configuration is.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000575,"input_tokens":3366,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98533':16A,19A 'accord':136C 'alreadi':126C 'attack':69B 'bdev':92C 'cve':14A,17A 'dereferenc':115C 'dm':5A,21B,45B,85C,101C 'dm-veriti':4A,20B,44B,84C,100C 'enforc':38B 'evalu':51B,111C,124C 'follow':76C 'free':41B,60B,94C 'freed':9A 'fw':132C 'gain':70B 'guidelin':139C 'hash':8A,48B,88C,98C,120C 'host':30B 'infrastructur':23B 'integr':36B 'ipe':3A,24B,35B,81C,91C 'kernel':2A,27B,33B,74C 'latest':138C 'linux':1A,26B,32B,73C 'linux-kernel':25B 'lock':131C 'model':134C 'modul':39B 'name':135C 'new':105C 'old':43B,96C 'one':106C 'path':125C 'polici':37B,50B,110C 'preresum':108C 'protect':82C,117C 'publish':103C 'race':61B 'rcu':90C,122C,129C 'read':54B,130C 'remov':133C 'resolv':80C 'root':7A,47B,87C,97C,119C 'run':127C 'say':66B 'self':29B 'self-host':28B 'setintegr':93C 'sourc':63B 'still':11A,53B,113C 'use':13A,58B 'use-after-fre':57B 'veriti':6A,22B,46B,86C,102C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPE enabled and dm-verity-backed block devices used with IPE integrity policies are the relevant ones. The sources do not say which kernel versions are affected or how common the configuration is.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98533","severity":null,"published_at":"2026-10-18T16:17:04+00:00","modified_at":"2026-10-19T10:19:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}