CVE-2026-99135: dm-integrity: fix infinite loop on discard with large tag size
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix infinite loop on discard with large tag size
When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksumsonstack and maxsize is set to HASHMAXDIGESTSIZE. So if the tag size is larger than HASHMAXDIGESTSIZE, maxblocks is zero, bisize is never decremented and the loop never terminates.
Fix this by using sizeof(checksumsonstack) as maxsize. The array has MAXTAGSIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so maxblocks is at least 1.