{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90052", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.783Z", "datePublished": "2026-09-17T16:05:38.281Z", "dateUpdated": "2026-09-17T16:05:38.281Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-17T16:05:38.281Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow with keyed discard\n\nSince commit 68c5c42567bc (\"dm-integrity: replace forgeable discard\nfiller with a keyed sector marker\"), integrity_metadata computes a\nchecksum for every discarded block into the \"checksums\" buffer.\nintegrity_sector_checksum always writes the whole digest. So if the tag\nsize is smaller than the digest size, the checksum of the last block\nthat fits into the buffer is written past the end of it. For example,\nwith hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past\nthe kmalloc'ed page.\n\nFix this by subtracting extra_space from the buffer size when computing\nmax_blocks, like we do for writes."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/dm-integrity.c"], "versions": [{"version": "5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775", "lessThan": "9988c1c9e0d1c78391e3d8e2817beb667470c76f", "status": "affected", "versionType": "git"}, {"version": "6228722c27304e4682cddc1fede03898f87e4414", "lessThan": "dd08a645195f410f2dcaa40de379a45ce110e873", "status": "affected", "versionType": "git"}, {"version": "68c5c42567bc462139128968ebbfadd0aefff519", "lessThan": "59e6f919d77d72ec79cbf171256f2f7819737580", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/dm-integrity.c"], "versions": [{"version": "7.3-rc1", "status": "affected"}, {"version": "0", "lessThan": "7.3-rc1", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.3-rc1", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9988c1c9e0d1c78391e3d8e2817beb667470c76f"}, {"url": "https://git.kernel.org/stable/c/dd08a645195f410f2dcaa40de379a45ce110e873"}, {"url": "https://git.kernel.org/stable/c/59e6f919d77d72ec79cbf171256f2f7819737580"}], "title": "dm-integrity: fix buffer overflow with keyed discard", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/dm-integrity.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9988c1c9e0d1c78391e3d8e2817beb667470c76f", "status": "affected", "version": "5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775", "versionType": "git"}, {"lessThan": "dd08a645195f410f2dcaa40de379a45ce110e873", "status": "affected", "version": "6228722c27304e4682cddc1fede03898f87e4414", "versionType": "git"}, {"lessThan": "59e6f919d77d72ec79cbf171256f2f7819737580", "status": "affected", "version": "68c5c42567bc462139128968ebbfadd0aefff519", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/dm-integrity.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.3-rc1"}, {"lessThan": "7.3-rc1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow with keyed discard\n\nSince commit 68c5c42567bc (\"dm-integrity: replace forgeable discard\nfiller with a keyed sector marker\"), integrity_metadata computes a\nchecksum for every discarded block into the \"checksums\" buffer.\nintegrity_sector_checksum always writes the whole digest. So if the tag\nsize is smaller than the digest size, the checksum of the last block\nthat fits into the buffer is written past the end of it. For example,\nwith hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past\nthe kmalloc'ed page.\n\nFix this by subtracting extra_space from the buffer size when computing\nmax_blocks, like we do for writes."}], "id": "CVE-2026-90052", "lastModified": "2026-09-17T17:16:53.610", "metrics": {}, "published": "2026-09-17T17:16:53.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59e6f919d77d72ec79cbf171256f2f7819737580"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9988c1c9e0d1c78391e3d8e2817beb667470c76f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd08a645195f410f2dcaa40de379a45ce110e873"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}