CVE-2026-99037: dm-crypt: reject the lmk IV mode with AEAD ciphers

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: reject the lmk IV mode with AEAD ciphers

A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets tfmscount to 64, but cryptalloctfmsaead only allocates one transform, so cryptsetkey reads past the end of the tfmsaead array and calls cryptoaeadsetkey on the values it finds there.

lmk exists for compatibility with Loop-AES, which uses CBC, so refuse it with an AEAD cipher rather than allocate 64 AEAD transforms. The check cannot go in cryptivlmkctr with the other lmk checks, because the IV constructor runs after cryptsetkey.

Note that this is not a security bug because the memory corruption can only be triggered by root.