Live › vulnerability › CVE-2026-99135
Go to dashboardWhen dm-integrity handles a discard on a device with a tag size larger than HASH_MAX_DIGESTSIZE and the buffer allocation fails, the kernel enters an infinite loop. The result is a hung kernel thread and a denial of service on the affected system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems that use the dm-integrity device-mapper target with a large integrity tag size, typically on a host where kmalloc can fail under memory pressure. Hosts that do not use dm-integrity are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix infinite loop on discard with large tag size
When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the tags, max_blocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the tag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size is never decremented and the loop never terminates.
Fix this by using sizeof(checksums_onstack) as max_size. The array has MAX_TAG_SIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so max_blocks is at least 1.
This page as .md · .json · in your agent: get_signal("CVE-2026-99135")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.