Live › vulnerability › CVE-2026-99086
Go to dashboardThe Linux kernel's dm-integrity device-mapper target re-reads its superblock on resume without validating it, so a user who edits the superblock while the device is suspended can make the journal index run past its end. The sources describe a kernel write through a NULL page address, which the fix addresses by refusing to resume when the on-disk geometry has changed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run dm-integrity volumes on a Linux kernel without the fix, most often where the device can be written by someone other than the operator while the mapping is suspended. Hosts that do not use dm-integrity, or that have no untrusted or multi-user access to the underlying block device, are unlikely to be exposed. Managed systems where the kernel is supplied by a vendor can skip the manual steps and wait for the distribution update.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel version in your distribution's advisory (unknown in the sources).dmsetup table (look for the integrity target type).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: validate the superblock on resume
dm_integrity_resume() re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor validates the superblock it reads and sizes all the in-memory structures according to it. The user may modify the superblock on the underlying device while the dm-integrity device is suspended, so that the two no longer agree.
In particular, access_journal_data() shifts the journal entry index by ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the journal page list were computed with the value that was present at constructor time. Increasing log2_sectors_per_block makes the index run past the end of the journal, and dm-integrity then writes 512 bytes through lowmem_page_address(NULL).
Snapshot the validated superblock in the constructor and refuse to resume if any of the fields that describe the on-disk geometry changed.
This page as .md · .json · in your agent: get_signal("CVE-2026-99086")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.