CVE-2026-90333: dm-integrity: replace forgeable discard filler with a keyed sector marker
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: replace forgeable discard filler with a keyed sector marker
The discard-block check in dmintegrityrwtag() treats a stored tag of all 0xf6 bytes (DISCARDFILLER) as proof a block was discarded and skips HMAC verification. allowdiscards is only accepted in dm-integrity's standalone mode. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with an all-0xf6 tag and have it served as authentic.
Add a new "allowdiscardskeyed" target argument that marks discarded blocks with a keyed checksum of (salt || sector) instead, computed by integritydiscardchecksum().
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using dm-integrity in standalone mode with discard support enabled are exposed if an attacker has raw write access to the backing device but does not possess the integrity key.
What does an attacker need to do to bypass integrity verification?
The attacker needs raw write access to the backing device and can replace a block's stored tag with all 0xf6 bytes. The discard-block check then treats the block as discarded and skips HMAC verification.
Does this affect every dm-integrity configuration?
No. The described vulnerable discard handling applies because allow_discards is accepted only in dm-integrity standalone mode.
What configuration change addresses the issue?
Use the new allow_discards_keyed target argument, which marks discarded blocks using a keyed checksum of the salt and sector rather than the forgeable fixed discard filler.