UBUNTU-CVE-2026-90333: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag() treats a stored tag of all 0xf6 bytes (DISCARDFILLER) as proof a block was discarded and skips HMAC verification. allowdiscards is only accepted in dm-integrity's standalone mode. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with an all-0xf6 tag and have it served as authentic. Add a new "allowdiscardskeyed" target argument that marks discarded blocks with a keyed checksum of (salt || sector) instead, computed by integritydiscardchecksum().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Enable the allow_discards_keyed target argument so discarded blocks are marked with a keyed checksum of (salt || sector), computed by integrity_discard_checksum().
dm-integrity allow_discards_keyed = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using dm-integrity in standalone mode with discard support enabled are exposed. The issue applies when an attacker can write directly to the underlying backing device but does not possess the integrity key.
What must an attacker do to exploit it?
The attacker needs raw write access to the backing device and can replace a block's integrity tag with bytes all set to 0xf6. The affected discard-block check accepts that tag as evidence of a discarded block and bypasses HMAC verification.
Is dm-integrity's default configuration affected?
The vulnerable behavior depends on discard support, and allow_discards is accepted only in dm-integrity standalone mode. The provided information does not establish that discard support is enabled by default.
What change addresses the problem?
The fix introduces the allow_discards_keyed target argument. It marks discarded blocks using a keyed checksum of the salt and sector, rather than the forgeable fixed discard filler.