---
id: "CVE-2026-99086"
kind: "vulnerability"
aliases: ["CVE-2026-99086"]
title: "Linux kernel dm-integrity: resume trusts a changed superblock, causing a crash"
severity: "unknown"
cvss: null
epss: 0.00206
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["device-mapper", "dm-integrity", "infrastructure", "kernel", "linux", "self-hosted"]
not_affected_if: ["no-dm-integrity", "no-untrusted-block-access"]
published_at: "2026-10-23T13:17:33+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99086", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99086", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel dm-integrity: resume trusts a changed superblock, causing a crash

The Linux kernel's dm-integrity device-mapper target re-reads its superblock on resume without validating it, so a user who edits the superblock while the device is suspended can make the journal index run past its end. The sources describe a kernel write through a NULL page address, which the fix addresses by refusing to resume when the on-disk geometry has changed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown in the sources).
- Check whether dm-integrity is in use with `dmsetup table` (look for the `integrity` target type).
- unknown for anything beyond that; the sources do not give a check for the exposure window.

## Fix

- Update the Linux kernel to a release that includes the upstream dm-integrity superblock validation fix (exact version unknown in the sources).
- Reboot into the patched kernel after updating.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99086
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99086

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: validate the superblock on resume

dm_integrity_resume() re-reads the superblock from the device so that it
picks up the flags and the recalculate position. It performs no
validation on the result, while the constructor validates the superblock
it reads and sizes all the in-memory structures according to it. The user
may modify the superblock on the underlying device while the dm-integrity
device is suspended, so that the two no longer agree.

In particular, access_journal_data() shifts the journal entry index by
ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the
journal page list were computed with the value that was present at
constructor time. Increasing log2_sectors_per_block makes the index run
past the end of the journal, and dm-integrity then writes 512 bytes
through lowmem_page_address(NULL).

Snapshot the validated superblock in the constructor and refuse to resume
if any of the fields that describe the on-disk geometry changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_