Live › vulnerability › CVE-2026-99136
Go to dashboardIn the Linux kernel's dm-crypt disk encryption layer, a race in crypt_dec_pending can read a stale error status before the final reference drop, so a failed read or write gets completed as successful. The impact is data-integrity: an application may treat failed or undecrypted data as valid, and the sources describe no code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running the Linux kernel with the device-mapper dm-crypt target active, such as LUKS-encrypted volumes. Hosts without dm-crypt devices are not exposed to this path. The sources do not give a fixed version or a configuration that narrows exposure further.
No product ranges from the sources yet.
uname -r and whether dm-crypt is in use with dmsetup table or lsblk -o NAME,TYPE showing crypt devices.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dm-crypt: fix a tiny race condition in crypt_dec_pending
crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrupt, may set io->error and drop its reference between the read and the decrement. crypt_dec_pending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful.
The read was placed before the decrement by commit b35f8caa0890 ("dm crypt: wait for endio to complete before destruction"), because that commit freed dm_crypt_io before calling bio_endio. This is no longer the case, dm_crypt_io lives in the per-bio data now.
Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is fully ordered, so no additional barrier is needed.
This page as .md · .json · in your agent: get_signal("CVE-2026-99136")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.