{"id":"CVE-2026-99098","kind":"vulnerability","aliases":["CVE-2026-99098"],"related":[],"title":"Linux kernel dm-integrity: large tag size overflows on-stack checksum buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow in inline mode with large tag size\n\nIn inline mode, dm_integrity_check and dm_integrity_inline_recheck\ncompute the checksum of each block into an on-stack buffer of\nHASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result\nwith zeroes up to the tag size, so if the tag size is larger than\nHASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With\nCONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the\nfirst read.\n\nEnlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5\n(\"dm integrity: fix a crash with unusually large tag size\") did for\nintegrity_metadata.\n\nNote that this is not a security bug because the buffer overflow can only\nbe triggered by root.","summary":"In inline mode, dm-integrity computes block checksums into a stack buffer sized HASH_MAX_DIGESTSIZE, but padding to a larger tag size writes past its end. The kernel panics on the first read, and the sources state only root can trigger it and that it is not a security bug.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-mapper","dm-integrity","infrastructure","kernel","linux"],"not_affected_if":["no-dm-integrity","small-tag-size"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:02+00:00","updated_at":"2026-10-26T16:04:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:04:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel dm-integrity: large tag size overflows on-stack checksum buffer","impact":"low","summary":"In inline mode, dm-integrity computes block checksums into a stack buffer sized HASH_MAX_DIGESTSIZE, but padding to a larger tag size writes past its end. The kernel panics on the first read, and the sources state only root can trigger it and that it is not a security bug.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","device-mapper","dm-integrity"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel panic on read; root-only trigger, not a security bug","analyst_note":"Confirm affected kernel version range and the fixing stable commit from the NVD entry or the kernel git tree.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-dm-integrity","small-tag-size"],"who_is_affected":"Systems that use dm-integrity in inline mode with a tag size larger than HASH_MAX_DIGESTSIZE. The sources do not name the affected kernel versions or the fixed release. Machines that do not use dm-integrity are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000586,"input_tokens":3546,"output_tokens":462,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-99098':17A,20A 'b93b6643e9b5':191C 'block':37B,121C 'buffer':14A,42B,96C,127C,165C,182C,216C 'bug':81B,213C 'byte':132C,188C 'check':110C,175C 'checksum':13A,38B,118C,135C 'commit':190C 'comput':36B,116C 'config':167C 'crash':196C 'cve':15A,18A 'devic':22B 'device-mapp':21B 'digests':46B,131C,156C 'dm':4A,25B,34B,93C,108C,112C,173C,192C 'dm-integr':3A,24B,33B,92C 'end':57B,162C 'enlarg':180C 'first':63B,178C 'fix':95C,194C 'follow':87C 'hash':44B,129C,154C 'hold':184C 'infrastructur':27B 'inlin':31B,99C,106C,114C 'integr':5A,26B,35B,94C,109C,113C,133C,174C,193C,204C 'kernel':2A,28B,59B,85C,170C 'larg':6A,102C,199C 'larger':51B,152C 'linux':1A,29B,84C 'mapper':23B 'max':45B,130C,155C,185C 'metadata':205C 'mode':32B,100C,107C 'note':206C 'on-stack':10A,124C 'overflow':9A,97C,217C 'pad':48B,136C,158C 'panic':60B,171C 'past':55B,160C 'read':64B,179C 'recheck':115C 'resolv':91C 'result':138C 'root':70B,223C 'run':159C 'sector':134C 'secur':80B,212C 'size':8A,43B,53B,104C,145C,150C,187C,201C 'sourc':67B 'stack':12A,41B,126C 'stackprotector':168C 'state':68B 'tag':7A,52B,103C,144C,149C,186C,200C 'trigger':72B,221C 'unusu':198C 'vulner':88C 'write':54B 'zero':140C","nicknames":[],"mitigations":[],"who_affected":"Systems that use dm-integrity in inline mode with a tag size larger than HASH_MAX_DIGESTSIZE. The sources do not name the affected kernel versions or the fixed release. Machines that do not use dm-integrity are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99098","severity":null,"published_at":"2026-10-26T15:16:48+00:00","modified_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}