CVE-2026-90052: dm-integrity: fix buffer overflow with keyed discard
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix buffer overflow with keyed discard
Since commit 68c5c42567bc ("dm-integrity: replace forgeable discard filler with a keyed sector marker"), integritymetadata computes a checksum for every discarded block into the "checksums" buffer. integritysectorchecksum always writes the whole digest. So if the tag size is smaller than the digest size, the checksum of the last block that fits into the buffer is written past the end of it. For example, with hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past the kmalloc'ed page.
Fix this by subtracting extraspace from the buffer size when computing maxblocks, like we do for writes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the Linux kernel fix for the vulnerability described as "dm-integrity: fix buffer overflow with keyed discard" (the resolution is to subtract extra_space from the buffer size when computing integrity_sector_checksum so the digest does not write past the end of the kmalloc'ed page).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Linux kernel dm-integrity configurations using keyed discard where the integrity tag size is smaller than the digest size. The example provided is HMAC-SHA256 with a 16-byte tag.
What operation triggers the overflow?
A discard operation triggers checksum generation for discarded blocks in the checksums buffer. When the final block fits according to tag size but its full digest does not, the digest write extends beyond the buffer; the provided example is a 4 MiB discard writing 16 bytes past a kmalloc-backed page.
Is an unconfigured or default dm-integrity setup known to be affected?
The available information identifies keyed discard and a tag size smaller than the digest size as required conditions. It does not state whether these settings are enabled by default.
What does the fix change?
The fix subtracts extra_space from the checksum-buffer size when calculating max_blocks, matching the existing write-path handling. This prevents the final full digest from being written beyond the buffer.