CVE-2026-99098— dm-integrity: fix buffer overflow in inline mode with large tag size

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： dm-integrity：修复 inline 模式下因标签（tag）尺寸过大导致的缓冲区溢出问题。在 inline 模式下，和函数会将每个数据块的校验和计算结果写入一个大小为字节的栈上缓冲区。函数会将其计算结果用零填充至标签尺寸；因此，若标签尺寸大于，填充操作将超出缓冲区边界。当启用了时，内核会在首次读取操作调用时触发 panic（内核崩溃）。修复方法是：将上述两个缓冲区的容量扩大至字节，这与之前提交 b93b6643e9b5（"dm integri

AI Predicted 6.5 Difficulty: Hard Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1069.001 · Local Groups

Updated Oct 26, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

dm-integrity: fix buffer overflow in inline mode with large tag size

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read. Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	fb0987682c629c1d2c476f35f6fde405a5e304a4 ~ 3c7aad85aeb9e28386672e3a009aa2e61f751b86	-
Linux	Linux	6.11	-

II. Public POCs for CVE-2026-99098

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99098

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99098 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99098

Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total

CVE-2026-99099		x86/CPU/AMD: Fix AMD TLBI Erratum #1718
CVE-2026-99097		tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
CVE-2026-99095		drm/vc4: drain the hangcheck timer and works on V3D unbind
CVE-2026-99096		io_uring/register: don't exempt disabled rings from task restrictions
CVE-2026-99094		Bluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99093		mm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99092		riscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99090		drm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99091		Bluetooth: MGMT: Fix status of pending commands flushed on power off
CVE-2026-99089		ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99088		net: openvswitch: validate transport header presence in set_ipv6_addr

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux