Unknown severity · Source severity not reportedCVE-2026-99098

dm-integrity: fix buffer overflow in inline mode with large tag sizeCVE-2026-99098

Answer in brief

CVE-2026-99098 records a Unknown severity vulnerability in dm-integrity: fix buffer overflow in inline mode with large tag size. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 26, 2026Updated Oct 26, 2026Source checked Oct 26, 2026First seen by HOL Oct 26, 2026Material review Oct 26, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=fb0987682c629c1d2c476f35f6fde405a5e304a4 <3c7aad85aeb9e28386672e3a009aa2e61f751b86 \|\| >=fb0987682c629c1d2c476f35f6fde405a5e304a4 <4f0ee735dc68e3e6c4dd9a666d7f7047163c4165 \|\| >=fb0987682c629c1d2c476f35f6fde405a5e304a4 <f49cd7820cd0a96f20e1aa2708adb002124e38a7 \|\| >=fb0987682c629c1d2c476f35f6fde405a5e304a4 <764b683a6180fd72c931c13fea98d383506a3475	3c7aad85aeb9e28386672e3a009aa2e61f751b86, 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165, f49cd7820cd0a96f20e1aa2708adb002124e38a7, 764b683a6180fd72c931c13fea98d383506a3475
Linux/Linuxgeneric	6.11	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 3c7aad85aeb9e28386672e3a009aa2e61f751b86 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 26, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read. Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.

Quoted source text, attributed separately from HOL analysis.