CVE-2026-99086 - Vulnerability Details

- dm-integrity: validate the superblock on resume

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: validate the superblock on resume

dm_integrity_resume() re-reads the superblock from the device so that it
picks up the flags and the recalculate position. It performs no
validation on the result, while the constructor validates the superblock
it reads and sizes all the in-memory structures according to it. The user
may modify the superblock on the underlying device while the dm-integrity
device is suspended, so that the two no longer agree.

In particular, access_journal_data() shifts the journal entry index by
ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the
journal page list were computed with the value that was present at
constructor time. Increasing log2_sectors_per_block makes the index run
past the end of the journal, and dm-integrity then writes 512 bytes
through lowmem_page_address(NULL).

Snapshot the validated superblock in the constructor and refuse to resume
if any of the fields that describe the on-disk geometry changed.

Published: 2026-10-23

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An omission in the dm-integrity subsystem causes the kernel to re‑read a superblock after resumption without verifying its integrity. If the on‑disk geometry has been altered while the device was suspended, the kernel miscalculates journal offsets, writes beyond an intended memory boundary, and corrupts kernel memory. The resulting corruption can be leveraged to gain kernel privileges.

Affected Systems

All Linux kernel builds that compile dm-integrity and have not incorporated commit 454b67fcc28c18502e47dfb9f067b04c28628ada are affected. This includes mainstream releases and custom kernels that omit the added superblock validation. Devices using any dm‑integrity target on removable or non‑volatile storage are vulnerable when the integrity module is suspended.

Risk and Exploitability

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1% reflects a low probability of public exploitation. The vulnerability requires local or administrative access to the block device to modify the superblock, making the attack vector local. Successful exploitation would overwrite kernel memory and could result in a system crash or privilege escalation. Although not listed in the CISA KEV catalog, the potential for kernel corruption warrants prompt attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c6138af1f5454c2631a837916fda958ea72c0d71`	affected	< 0499b6d1c9d4477d6538b88c30f9d0c1a28b3e75
`38625191f32f77a9d5fc7cc15f4f9b78768bfb33`	affected	< 454b67fcc28c18502e47dfb9f067b04c28628ada
`118ba36e446c01e3cd34b3eedabf1d9436525e1d`	affected	< e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e
`118ba36e446c01e3cd34b3eedabf1d9436525e1d`	affected	< fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2
`824b9c27d7b600520b95f0cab95a47d1b08a9483`	affected	—
`fb49f209995f729053c6ee728436f98d78a49b6f`	affected	—
`3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f`	affected	—
`6.12.75`	affected	< 6.12.117
`6.18.16`	affected	< 6.18.58
`6.1.165`	affected	< 6.2
`6.6.128`	affected	< 6.7
`6.19.6`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.12.117`	unaffected	≤ 6.12.*
`6.18.58`	unaffected	≤ 6.18.*
`7.2.12`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[38625191f32f77a9d5fc7cc15f4f9b78768bfb33,454b67fcc28c18502e47dfb9f067b04c28628ada)`	affected	code_commit	—
`[118ba36e446c01e3cd34b3eedabf1d9436525e1d,e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e)`	affected	code_commit	—
`[118ba36e446c01e3cd34b3eedabf1d9436525e1d,fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2)`	affected	code_commit	—
`[824b9c27d7b600520b95f0cab95a47d1b08a9483,*]`	affected	code_commit	—
`[fb49f209995f729053c6ee728436f98d78a49b6f,*]`	affected	code_commit	—
`[c6138af1f5454c2631a837916fda958ea72c0d71,*]`	affected	code_commit	—
`[3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f,*]`	affected	code_commit	—
`[6.18.16,6.18.58)`	affected	semver	—
`[6.1.165,6.2.0)`	affected	semver	—
`[6.6.128,6.7.0)`	affected	semver	—
`[6.12.75,6.13.0)`	affected	semver	—
`[6.19.6,6.20.0)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[7.0.0,*]`	affected	semver	—
`[0,7.0.0)`	unaffected	semver	—
`[6.18.58,6.19.0)`	unaffected	semver	—
`[7.2.12,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[38625191f32f77a9d5fc7cc15f4f9b78768bfb33,454b67fcc28c18502e47dfb9f067b04c28628ada)`	affected	code_commit	—
`[118ba36e446c01e3cd34b3eedabf1d9436525e1d,e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e)`	affected	code_commit	—
`[118ba36e446c01e3cd34b3eedabf1d9436525e1d,fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2)`	affected	code_commit	—
`[824b9c27d7b600520b95f0cab95a47d1b08a9483,*]`	affected	code_commit	—
`[fb49f209995f729053c6ee728436f98d78a49b6f,*]`	affected	code_commit	—
`[c6138af1f5454c2631a837916fda958ea72c0d71,*]`	affected	code_commit	—
`[3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f,*]`	affected	code_commit	—
`[6.18.16,6.18.58)`	affected	semver	—
`[6.1.165,6.2.0)`	affected	semver	—
`[6.6.128,6.7.0)`	affected	semver	—
`[6.12.75,6.13.0)`	affected	semver	—
`[6.19.6,6.20.0)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[7.0.0,*]`	affected	semver	—
`[0,7.0.0)`	unaffected	semver	—
`[6.18.58,6.19.0)`	unaffected	semver	—
`[7.2.12,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version containing commit 454b67fcc28c18502e47dfb9f067b04c28628ada, which validates the superblock during resume.
If an update is not immediately possible, disable or remove dm-integrity devices before rebooting, and avoid accessing the underlying block device during suspension.
Restrict write access to the affected block device and employ tamper‑detection or cryptographic verification to detect unexpected changes before resuming.
Check kernel logs for dm-integrity errors and plan for a timely patch or device removal.

Generated by OpenCVE AI on October 27, 2026 at 18:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99086.mbox
https://git.kernel.org/stable/c/0499b6d1c9d4477d6538b88c30f9d0c1a28b3e75
https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada
https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e
https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2
https://nvd.nist.gov/vuln/detail/CVE-2026-99086
https://www.cve.org/CVERecord?id=CVE-2026-99086

History

Tue, 10 Nov 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0499b6d1c9d4477d6538b88c30f9d0c1a28b3e75

Tue, 27 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-787

Tue, 27 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99086.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99086 https://www.cve.org/CVERecord?id=CVE-2026-99086
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-787

Fri, 23 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor validates the superblock it reads and sizes all the in-memory structures according to it. The user may modify the superblock on the underlying device while the dm-integrity device is suspended, so that the two no longer agree. In particular, access_journal_data() shifts the journal entry index by ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the journal page list were computed with the value that was present at constructor time. Increasing log2_sectors_per_block makes the index run past the end of the journal, and dm-integrity then writes 512 bytes through lowmem_page_address(NULL). Snapshot the validated superblock in the constructor and refuse to resume if any of the fields that describe the on-disk geometry changed.
Title		dm-integrity: validate the superblock on resume
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:45:04.496Z

Updated: 2026-11-10T18:15:23.819Z

Reserved: 2026-09-25T10:25:14.390Z

Link: CVE-2026-99086

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:33.113

Modified: 2026-11-10T19:22:30.060

Link: CVE-2026-99086

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99086 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T18:30:08Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object