DEBIAN-CVE-2026-99135: Debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksumsonstack and maxsize is set to HASHMAXDIGESTSIZE. So if the tag size is larger than HASHMAXDIGESTSIZE, maxblocks is zero, bisize is never decremented and the loop never terminates. Fix this by using sizeof(checksumsonstack) as maxsize. The array has MAXTAGSIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so maxblocks is at least 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In dm-integrity's integrity_metadata discard handling, use sizeof(checksums_onstack) as max_size so max_blocks is at least 1 and the discard loop terminates even when the tag size exceeds HASH_MAX_DIGESTSIZE.