{"id":"CVE-2026-99098","summary":"dm-integrity: fix buffer overflow in inline mode with large tag size","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow in inline mode with large tag size\n\nIn inline mode, dm_integrity_check and dm_integrity_inline_recheck\ncompute the checksum of each block into an on-stack buffer of\nHASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result\nwith zeroes up to the tag size, so if the tag size is larger than\nHASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With\nCONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the\nfirst read.\n\nEnlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5\n(\"dm integrity: fix a crash with unusually large tag size\") did for\nintegrity_metadata.\n\nNote that this is not a security bug because the buffer overflow can only\nbe triggered by root.","modified":"2026-10-28T02:48:55.249710617Z","published":"2026-10-26T14:52:04.416Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99098.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3c7aad85aeb9e28386672e3a009aa2e61f751b86"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4f0ee735dc68e3e6c4dd9a666d7f7047163c4165"},{"type":"WEB","url":"https://git.kernel.org/stable/c/764b683a6180fd72c931c13fea98d383506a3475"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f49cd7820cd0a96f20e1aa2708adb002124e38a7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99098.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99098"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fb0987682c629c1d2c476f35f6fde405a5e304a4"},{"fixed":"3c7aad85aeb9e28386672e3a009aa2e61f751b86"},{"fixed":"4f0ee735dc68e3e6c4dd9a666d7f7047163c4165"},{"fixed":"f49cd7820cd0a96f20e1aa2708adb002124e38a7"},{"fixed":"764b683a6180fd72c931c13fea98d383506a3475"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99098.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.12.114"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99098.json"}}],"schema_version":"1.9.2"}