CVE-2026-93257: block: handle nogenerate/noverify properly in fs-integrity
In the Linux kernel, the following vulnerability has been resolved:
block: handle nogenerate/noverify properly in fs-integrity
Check the BIPCHECK flags before generating or verifying PI information, otherwise this can be incorrectly called for non-PI metadata and cause generation of incorrect metadata and crashed in the verification handler.
The new behavior matches that of the block layer auto-generated metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Check the BIP_CHECK flags before generating or verifying protection information (PI) metadata.
Linux kernel fs-integrity BIP_CHECK flags = check before generating or verifying PI information
Event History
Frequently Asked Questions
What configurations are exposed to this issue?
Systems using fs-integrity with protection-information handling are affected when BIP_CHECK nogenerate or noverify flags are not honored. The issue involves non-PI metadata being incorrectly sent through PI generation or verification handling.
What can happen if the issue is triggered?
Incorrect metadata may be generated, and the verification handler can crash. The description does not state any additional attacker prerequisites or impact beyond this failure mode.
How can I determine whether a system needs the fix?
Review whether the running kernel includes either referenced stable commit and whether the deployment uses fs-integrity protection-information metadata handling. The provided data does not identify affected kernel versions.
What should be done if patching cannot happen immediately?
The provided information does not specify a workaround. Reducing or avoiding fs-integrity PI operations involving non-PI metadata may limit exposure, but this is not stated as a validated mitigation.