The kernel device‑mapper integrity module processes discard requests by writing a filler buffer across tags, blocks at a time. When the buffer allocation fails, the module incorrectly sets the maximum block size to HASH_MAX_DIGESTSIZE; if the configured tag size exceeds that value, the block counter never decrements, causing an infinite loop and a system hang. This flaw can be exercised by any discard operation that triggers the logic with a large tag size, leading to a pure denial of service without data loss.

All Linux kernel installations that enable the dm-integrity subsystem with tag sizes larger than HASH_MAX_DIGESTSIZE are potentially affected. The vulnerability is fixed by a kernel commit that adjusts the calculation of the maximum block size to use the actual on‑stack array size. Therefore, any kernel version prior to that commit on which the device‑mapper is enabled with large tags is vulnerable.

Based on the description, it is inferred that the attacker would need to issue a discard command on the target device, which typically requires local or privileged access. The likely attack vector is the execution of a discard operation on a device backed by dm-integrity with large tag sizes, triggering the infinite‑loop condition. A successful exploitation would result in a system hang, meeting the denial‑of‑service impact without compromising confidentiality or integrity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog, indicating a presently low exploitation probability but a valid attack surface.