UBUNTU-CVE-2026-99098: Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes. integritysectorchecksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASHMAXDIGESTSIZE, the padding runs past the end of the buffer. With CONFIGSTACKPROTECTOR the kernel panics in dmintegritycheck on the first read. Enlarge both buffers to hold MAXTAGSIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integritymetadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch b93b6643e9b5
Event History
Frequently Asked Questions
Who can trigger this issue?
Only root can trigger the overflow. The issue requires configuring dm-integrity inline mode with a tag size larger than HASH_MAX_DIGESTSIZE.
What is the expected impact on affected systems?
On kernels built with CONFIG_STACKPROTECTOR, the kernel panics in dm_integrity_check on the first read. The provided information characterizes this as not a security bug because exploitation requires root access.
How can I determine whether a system is exposed to the crash condition?
Check whether dm-integrity is used in inline mode with an unusually large tag size exceeding HASH_MAX_DIGESTSIZE. The condition is reached when dm_integrity_check or dm_integrity_inline_recheck computes a block checksum and pads it to that tag size.