{"id":"CVE-2026-99087","kind":"vulnerability","aliases":["CVE-2026-99087"],"related":[],"title":"Linux kernel dm-integrity: NULL pointer crash when activated in read-only mode","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the 'R' flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the 'R' mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the 'R' mode.","summary":"When a dm-integrity device has its dirty bitmap flag set and is activated in 'R' mode, the kernel dereferences a NULL pointer while reading the journal during resume. The result is a kernel crash, which is a denial of service on the host.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-mapper","dm-integrity","linux-kernel","runtime"],"not_affected_if":["no-dm-integrity"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:52:09+00:00","updated_at":"2026-10-25T04:52:09+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:52:09Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel dm-integrity: NULL pointer crash when activated in read-only mode","impact":"low","summary":"When a dm-integrity device has its dirty bitmap flag set and is activated in 'R' mode, the kernel dereferences a NULL pointer while reading the journal during resume. The result is a kernel crash, which is a denial of service on the host.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","device-mapper","dm-integrity"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user can crash the kernel via device activation","analyst_note":"Check the upstream kernel commit and stable backport list to find the fixed kernel versions; the NVD entry gives no version data.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-dm-integrity"],"who_is_affected":"Systems that use dm-integrity (device-mapper integrity targets) with the dirty bitmap flag set and activate devices with the 'R' flag. The sources do not name affected kernel versions. Hosts without dm-integrity devices are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00056,"input_tokens":3398,"output_tokens":440,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-99087':18A,21A 'activ':10A,46B,117C,162C 'attempt':134C 'bitmap':41B,111C,141C 'contain':139C 'crash':8A,67B,125C 'cve':16A,19A 'denial':71B 'derefer':52B,93C 'devic':23B,37B,105C,119C,153C,160C 'device-mapp':22B 'dirti':40B,110C 'dm':4A,26B,35B,88C,103C,127C,146C,155C 'dm-integr':3A,25B,34B,87C,102C,145C 'fix':90C 'flag':42B,97C,109C,112C 'follow':82C 'function':133C 'happen':130C 'host':76B 'integr':5A,27B,36B,89C,104C,128C,147C,156C 'journal':59B,138C 'kernel':2A,30B,51B,66B,80C 'linux':1A,29B,79C 'linux-kernel':28B 'make':144C 'mapper':24B 'mode':15A,49B,123C,166C 'null':6A,54B,91C 'patch':143C 'pointer':7A,55B,92C 'r':48B,96C,122C,165C 'read':13A,57B,136C 'read-on':12A 'resolv':86C 'result':63B 'resum':61B,129C,157C 'runtim':31B 'sb':108C 'servic':73B 'set':43B,113C 'skip':148C 'use':99C 'user':116C 'vulner':83C 'write':150C","nicknames":[],"mitigations":[],"who_affected":"Systems that use dm-integrity (device-mapper integrity targets) with the dirty bitmap flag set and activate devices with the 'R' flag. The sources do not name affected kernel versions. Hosts without dm-integrity devices are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99087","severity":null,"published_at":"2026-10-23T13:17:33+00:00","modified_at":"2026-10-23T13:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}