{"id":"CVE-2026-99086","kind":"vulnerability","aliases":["CVE-2026-99086"],"related":[],"title":"Linux kernel dm-integrity: resume trusts a changed superblock, causing a crash","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the\njournal page list were computed with the value that was present at\nconstructor time. Increasing log2_sectors_per_block makes the index run\npast the end of the journal, and dm-integrity then writes 512 bytes\nthrough lowmem_page_address(NULL).\n\nSnapshot the validated superblock in the constructor and refuse to resume\nif any of the fields that describe the on-disk geometry changed.","summary":"The Linux kernel's dm-integrity device-mapper target re-reads its superblock on resume without validating it, so a user who edits the superblock while the device is suspended can make the journal index run past its end. The sources describe a kernel write through a NULL page address, which the fix addresses by refusing to resume when the on-disk geometry has changed.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-mapper","dm-integrity","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["no-dm-integrity","no-untrusted-block-access"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown in the sources).\n- Check whether dm-integrity is in use with `dmsetup table` (look for the `integrity` target type).\n- unknown for anything beyond that; the sources do not give a check for the exposure window.","fix":"- Update the Linux kernel to a release that includes the upstream dm-integrity superblock validation fix (exact version unknown in the sources).\n- Reboot into the patched kernel after updating.","status":"open","published_at":"2026-10-23T13:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:52:10+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:52:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream dm-integrity superblock validation fix (exact version unknown in the sources).\n- Reboot into the patched kernel after updating.","reach":"local","title":"Linux kernel dm-integrity: resume trusts a changed superblock, causing a crash","impact":"medium","summary":"The Linux kernel's dm-integrity device-mapper target re-reads its superblock on resume without validating it, so a user who edits the superblock while the device is suspended can make the journal index run past its end. The sources describe a kernel write through a NULL page address, which the fix addresses by refusing to resume when the on-disk geometry has changed.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","device-mapper","dm-integrity","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel write through a NULL page address, causing a crash or memory corruption","analyst_note":"Find the upstream fix commit and the distribution kernel versions that carry it, and confirm whether an attacker needs block-device write access.","how_to_check":"- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown in the sources).\n- Check whether dm-integrity is in use with `dmsetup table` (look for the `integrity` target type).\n- unknown for anything beyond that; the sources do not give a check for the exposure window.","needs_analyst":true,"not_affected_if":["no-dm-integrity","no-untrusted-block-access"],"who_is_affected":"Systems that run dm-integrity volumes on a Linux kernel without the fix, most often where the device can be written by someone other than the operator while the mapping is suspended. Hosts that do not use dm-integrity, or that have no untrusted or multi-user access to the underlying block device, are unlikely to be exposed. Managed systems where the kernel is supplied by a vendor can skip the manual steps and wait for the distribution update.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":3552,"output_tokens":719,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99086':16A,19A '512':251C 'access':194C 'accord':164C 'address':84B,88B,256C 'agre':191C 'block':208C,234C 'byte':252C 'caus':11A 'chang':9A,100B,281C 'comput':220C 'constructor':150C,228C,264C 'crash':13A 'cve':14A,17A 'data':196C 'describ':76B,275C 'devic':21B,40B,62B,129C,176C,182C 'device-mapp':20B,39B 'disk':97B,279C 'dm':4A,24B,37B,112C,119C,180C,247C 'dm-integr':3A,23B,36B,111C,179C,246C 'edit':57B 'end':73B,241C 'entri':200C 'field':273C 'fix':87B 'flag':136C 'follow':106C 'geometri':98B,280C 'host':31B 'ic':203C,210C 'in-memori':160C 'increas':230C 'index':69B,201C,237C 'infrastructur':26B 'integr':5A,25B,38B,113C,120C,181C,248C 'journal':68B,195C,199C,211C,216C,244C 'kernel':2A,27B,34B,78B,104C 'linux':1A,28B,33B,103C 'list':218C 'log2':205C,231C 'longer':190C 'lowmem':254C 'make':66B,235C 'mapper':22B,41B 'may':169C 'memori':162C 'modifi':170C 'null':82B,257C 'on-disk':95B,277C 'page':83B,217C,255C 'particular':193C 'past':71B,239C 'per':207C,233C 'perform':142C 'pick':133C 'posit':140C 'present':226C 're':44B,123C 're-read':43B,122C 'read':45B,124C,155C 'recalcul':139C 'refus':90B,266C 'resolv':110C 'result':147C 'resum':6A,49B,92B,118C,121C,268C 'run':70B,238C 'sb':204C 'section':212C 'sector':206C,213C,232C 'self':30B 'self-host':29B 'shift':197C 'size':157C 'snapshot':258C 'sourc':75B 'structur':163C 'superblock':10A,47B,59B,116C,126C,153C,172C,261C 'suspend':64B,184C 'target':42B 'time':229C 'trust':7A 'two':188C 'under':175C 'user':55B,168C 'valid':51B,114C,144C,151C,260C 'valu':223C 'vulner':107C 'without':50B 'write':79B,250C","nicknames":[],"mitigations":[],"who_affected":"Systems that run dm-integrity volumes on a Linux kernel without the fix, most often where the device can be written by someone other than the operator while the mapping is suspended. Hosts that do not use dm-integrity, or that have no untrusted or multi-user access to the underlying block device, are unlikely to be exposed. Managed systems where the kernel is supplied by a vendor can skip the manual steps and wait for the distribution update.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99086","severity":null,"published_at":"2026-10-23T13:17:33+00:00","modified_at":"2026-10-23T13:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99086","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99086","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}