CVE-2026-99087

dm-integrity: fix NULL pointer dereference when the 'R' flag is used

Published Oct 23, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix NULL pointer dereference when the 'R' flag is used

If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the
user activates the device in the 'R' mode, a crash in dm_integrity_resume
happens because the function attempts to read the journal containing the
bitmap.

This patch makes dm-integrity skip any writes to the device in
dm_integrity_resume if the device is activated in the 'R' mode.

Analysis

Technical impact

The Linux kernel’s dm-integrity module contains a NULL pointer dereference bug that is triggered when a device with the SB_FLAG_DIRTY_BITMAP flag is activated in read-only mode. An attacker can cause dm_integrity_resume to crash while the kernel attempts to read an absent journal bitmap. This crash results in a kernel panic or reboot, effectively denying service to the system or any applications running on it.

Affected Systems

The vulnerability affects all Linux kernel releases that include the dm-integrity module prior to the patch merged in commit 2e25842f0e4423e0efb243f56153d842ed6b933f. Operating systems that ship these kernels—including most standard Linux distributions—are impacted, regardless of the vendor.

Risk and Exploitability

The CVSS score is 4.4, classifying it as low to medium severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The flaw requires the ability to activate a dm-integrity device in read-only mode while the SB_FLAG_DIRTY_BITMAP flag is set, which typically requires local or privileged access. An attacker can exploit the flaw to bring the system down, but no publicly available exploit has been reported. Because a kernel crash leads to denial of service, immediate remediation is strongly recommended.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`468dfca38b1a6fbdccd195d875599cb7c8875cd9`	affected	< 73e5b7b14df0430ef2135e9bd9fa3f5b253ef789
`468dfca38b1a6fbdccd195d875599cb7c8875cd9`	affected	< 2e25842f0e4423e0efb243f56153d842ed6b933f
`468dfca38b1a6fbdccd195d875599cb7c8875cd9`	affected	< 69ed43ed8a174465fca1ba6bfbde53e4618c8956
`468dfca38b1a6fbdccd195d875599cb7c8875cd9`	affected	< 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84

Linux

affected

Version	Status	Constraints
`5.2`	affected	—
`0`	unaffected	< 5.2
`6.12.117`	unaffected	≤ 6.12.*
`6.18.58`	unaffected	≤ 6.18.*
`7.2.12`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[468dfca38b1a6fbdccd195d875599cb7c8875cd9,2e25842f0e4423e0efb243f56153d842ed6b933f)`	affected	code_commit	—
`[468dfca38b1a6fbdccd195d875599cb7c8875cd9,69ed43ed8a174465fca1ba6bfbde53e4618c8956)`	affected	code_commit	—
`[468dfca38b1a6fbdccd195d875599cb7c8875cd9,7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84)`	affected	code_commit	—

Linux

Version	Status	Scheme	Platform
`5.2`	affected	generic	—
`[0,5.2)`	unaffected	generic	—
`[6.18.58,6.19.0)`	unaffected	semver	—
`[7.2.12,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[468dfca38b1a6fbdccd195d875599cb7c8875cd9,2e25842f0e4423e0efb243f56153d842ed6b933f)`	affected	code_commit	—
`[468dfca38b1a6fbdccd195d875599cb7c8875cd9,69ed43ed8a174465fca1ba6bfbde53e4618c8956)`	affected	code_commit	—
`[468dfca38b1a6fbdccd195d875599cb7c8875cd9,7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.2`	affected	generic	—
`[0,5.2)`	unaffected	generic	—
`[6.18.58,6.19.0)`	unaffected	semver	—
`[7.2.12,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains commit 2e25842f0e4423e0efb243f56153d842ed6b933f or later, which applies the null pointer dereference fix.
If an immediate kernel upgrade is not possible, do not activate dm-integrity devices in 'R' mode when the SB_FLAG_DIRTY_BITMAP flag is set, or remove the flag before activation.
After applying the update or disabling the vulnerable configuration, reboot the system to ensure the kernel is loaded from the patched image.

Generated by OpenCVE AI on October 27, 2026 at 13:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.164% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99087.mbox
https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f
https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956
https://git.kernel.org/stable/c/73e5b7b14df0430ef2135e9bd9fa3f5b253ef789
https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84
https://nvd.nist.gov/vuln/detail/CVE-2026-99087
https://www.cve.org/CVERecord?id=CVE-2026-99087

History

Nov 10, 2026 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/73e5b7b14df0430ef2135e9bd9fa3f5b253ef789

Oct 27, 2026 12:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99087.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99087 https://www.cve.org/CVERecord?id=CVE-2026-99087
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 24, 2026 1:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 4:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

Oct 23, 2026 1:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm_integrity_resume happens because the function attempts to read the journal containing the bitmap. This patch makes dm-integrity skip any writes to the device in dm_integrity_resume if the device is activated in the 'R' mode.
Title		dm-integrity: fix NULL pointer dereference when the 'R' flag is used
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956 https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84