AZL-111254: CVE-2026-99135 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix infinite loop on discard with large tag size
When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksumsonstack and maxsize is set to HASHMAXDIGESTSIZE. So if the tag size is larger than HASHMAXDIGESTSIZE, maxblocks is zero, bisize is never decremented and the loop never terminates.
Fix this by using sizeof(checksumsonstack) as maxsize. The array has MAXTAGSIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so maxblocks is at least 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In dm-integrity, fix the discard handling by using sizeof(checksums_onstack) as max_size.