{"id":"CVE-2026-99135","revision":"61c662f4464c4bd1b233852c0925333f","records":[{"revision":"61c662f4464c4bd1b233852c0925333f","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99135","aliases":[],"title":"dm-integrity: fix infinite loop on discard with large tag size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix infinite loop on discard with large tag size\n\nWhen integrity_metadata handles a discard, it fills a buffer with\nDISCARD_FILLER and writes it over the tags, max_blocks blocks at a\ntime. If the kmalloc fails, the buffer is the on-stack array\nchecksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the\ntag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size\nis never decremented and the loop never terminates.\n\nFix this by using sizeof(checksums_onstack) as max_size. The array has\nMAX_TAG_SIZE bytes since commit b93b6643e9b5 (\"dm integrity: fix a\ncrash with unusually large tag size\"), so max_blocks is at least 1.","state":0,"publishedAt":"2026-10-28T10:34:47.902+00:00","modifiedAt":"2026-10-30T12:42:08.647+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-integrity.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"f41a224b3c9d66c7b59afc7cae02a8b214f3c684\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"c66f5c6ccfa832d28b44a66c01e3468c246adac4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"41a18e6c6e2c4a912494a035c17ecfe79c68b9e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"bbc154a7da4e075aef720ef051aff6094400eb66\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"c4cba6670fa199415689f67108e96b0ba469d767\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"fc512700f1413fed652dac22fa1c4e837210b9c0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"251b44b424920df9204e88a81fb3f78fa48ddd99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"18d80c77b4c7dd20699e81cedfbbff4e9d198f28\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-integrity.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.273\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.224\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f41a224b3c9d66c7b59afc7cae02a8b214f3c684","https://git.kernel.org/stable/c/c66f5c6ccfa832d28b44a66c01e3468c246adac4","https://git.kernel.org/stable/c/41a18e6c6e2c4a912494a035c17ecfe79c68b9e6","https://git.kernel.org/stable/c/bbc154a7da4e075aef720ef051aff6094400eb66","https://git.kernel.org/stable/c/c4cba6670fa199415689f67108e96b0ba469d767","https://git.kernel.org/stable/c/fc512700f1413fed652dac22fa1c4e837210b9c0","https://git.kernel.org/stable/c/251b44b424920df9204e88a81fb3f78fa48ddd99","https://git.kernel.org/stable/c/18d80c77b4c7dd20699e81cedfbbff4e9d198f28"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99135","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99135","identifiers":["CVE-2026-99135"]},"retained":false,"historicalAffected":[]}],"coverage":[]}