---
id: "CVE-2026-99135"
kind: "vulnerability"
aliases: ["CVE-2026-99135"]
title: "Linux kernel dm-integrity: discard with large tags loops forever"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["device-mapper", "dm-integrity", "infrastructure", "linux-kernel"]
not_affected_if: ["no-dm-integrity"]
published_at: "2026-10-28T11:17:33+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:36:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99135", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel dm-integrity: discard with large tags loops forever

When dm-integrity handles a discard on a device with a tag size larger than HASH_MAX_DIGESTSIZE and the buffer allocation fails, the kernel enters an infinite loop. The result is a hung kernel thread and a denial of service on the affected system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Update the Linux kernel to a release that contains the upstream commit fixing dm-integrity max_size for discard (the fix uses sizeof(checksums_onstack) as max_size).

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99135

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix infinite loop on discard with large tag size

When integrity_metadata handles a discard, it fills a buffer with
DISCARD_FILLER and writes it over the tags, max_blocks blocks at a
time. If the kmalloc fails, the buffer is the on-stack array
checksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the
tag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size
is never decremented and the loop never terminates.

Fix this by using sizeof(checksums_onstack) as max_size. The array has
MAX_TAG_SIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a
crash with unusually large tag size"), so max_blocks is at least 1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_