Live › vulnerability › CVE-2026-99037
Go to dashboardLoading a dm-crypt table that pairs an AEAD cipher with the lmk IV mode makes the kernel read past a transform array and oops. The kernel project states only root can trigger it, so the impact is a local crash rather than privilege gain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Linux hosts that create dm-crypt devices with capi AEAD ciphers and the lmk IV mode, which requires root to load. Systems that use only standard dm-crypt ciphers such as aes-xts-plain64 are not affected.
No product ranges from the sources yet.
uname -r to see the running kernel versiondmsetup table to look for crypt targets using capi: ciphers with -lmk and an AEAD cipher such as gcm(aes)lmk IV mode with AEAD ciphers in dm-crypt tables until patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dm-crypt: reject the lmk IV mode with AEAD ciphers
A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets tfms_count to 64, but crypt_alloc_tfms_aead only allocates one transform, so crypt_setkey reads past the end of the tfms_aead array and calls crypto_aead_setkey on the values it finds there.
lmk exists for compatibility with Loop-AES, which uses CBC, so refuse it with an AEAD cipher rather than allocate 64 AEAD transforms. The check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because the IV constructor runs after crypt_set_key.
Note that this is not a security bug because the memory corruption can only be triggered by root.
This page as .md · .json · in your agent: get_signal("CVE-2026-99037")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.