{"id":"CVE-2026-99135","kind":"vulnerability","aliases":["CVE-2026-99135"],"related":[],"title":"Linux kernel dm-integrity: discard with large tags loops forever","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix infinite loop on discard with large tag size\n\nWhen integrity_metadata handles a discard, it fills a buffer with\nDISCARD_FILLER and writes it over the tags, max_blocks blocks at a\ntime. If the kmalloc fails, the buffer is the on-stack array\nchecksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the\ntag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size\nis never decremented and the loop never terminates.\n\nFix this by using sizeof(checksums_onstack) as max_size. The array has\nMAX_TAG_SIZE bytes since commit b93b6643e9b5 (\"dm integrity: fix a\ncrash with unusually large tag size\"), so max_blocks is at least 1.","summary":"When dm-integrity handles a discard on a device with a tag size larger than HASH_MAX_DIGESTSIZE and the buffer allocation fails, the kernel enters an infinite loop. The result is a hung kernel thread and a denial of service on the affected system.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-mapper","dm-integrity","infrastructure","linux-kernel"],"not_affected_if":["no-dm-integrity"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that contains the upstream commit fixing dm-integrity max_size for discard (the fix uses sizeof(checksums_onstack) as max_size).","status":"open","published_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:11+00:00","updated_at":"2026-10-28T11:36:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:36:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that contains the upstream commit fixing dm-integrity max_size for discard (the fix uses sizeof(checksums_onstack) as max_size).","reach":"local","title":"Linux kernel dm-integrity: discard with large tags loops forever","impact":"low","summary":"When dm-integrity handles a discard on a device with a tag size larger than HASH_MAX_DIGESTSIZE and the buffer allocation fails, the kernel enters an infinite loop. The result is a hung kernel thread and a denial of service on the affected system.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","device-mapper","dm-integrity"],"confidence":0.6,"needs_auth":"unknown","worst_case":"a kernel thread loops forever, hanging the affected host","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-dm-integrity"],"who_is_affected":"Systems that use the dm-integrity device-mapper target with a large integrity tag size, typically on a host where kmalloc can fail under memory pressure. Hosts that do not use dm-integrity are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000576,"input_tokens":3518,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99135':14A,17A '1':205C 'affect':72B 'alloc':50B 'array':132C,180C 'b93b6643e9b5':188C 'bi':159C 'block':116C,117C,156C,201C 'buffer':49B,105C,126C 'byte':185C 'checksum':133C,174C 'commit':187C 'crash':193C 'cve':12A,15A 'decrement':163C 'denial':67B 'devic':19B,37B 'device-mapp':18B 'digests':46B,143C,154C 'discard':6A,34B,91C,101C,107C 'dm':4A,22B,30B,85C,189C 'dm-integr':3A,21B,29B,84C 'enter':54B 'fail':51B,124C 'fill':103C 'filler':108C 'fix':87C,169C,191C 'follow':79C 'forev':11A 'handl':32B,99C 'hash':44B,141C,152C 'hung':62B 'infinit':56B,88C 'infrastructur':24B 'integr':5A,23B,31B,86C,97C,190C 'kernel':2A,27B,53B,63B,77C 'kmalloc':123C 'larg':8A,93C,196C 'larger':42B,150C 'least':204C 'linux':1A,26B,76C 'linux-kernel':25B 'loop':10A,57B,89C,166C 'mapper':20B 'max':45B,115C,136C,142C,153C,155C,177C,182C,200C 'metadata':98C 'never':162C,167C 'on-stack':129C 'onstack':134C,175C 'resolv':83C 'result':59B 'servic':69B 'set':139C 'sinc':186C 'size':41B,95C,137C,148C,160C,178C,184C,198C 'sizeof':173C 'stack':131C 'system':73B 'tag':9A,40B,94C,114C,147C,183C,197C 'termin':168C 'thread':64B 'time':120C 'unusu':195C 'use':172C 'vulner':80C 'write':110C 'zero':158C","nicknames":[],"mitigations":[],"who_affected":"Systems that use the dm-integrity device-mapper target with a large integrity tag size, typically on a host where kmalloc can fail under memory pressure. Hosts that do not use dm-integrity are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99135","severity":null,"published_at":"2026-10-28T11:17:33+00:00","modified_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}