{"id":"CVE-2026-99135","revision":"79b4e91fa00e4b909e5d495a5fd038e4","records":[{"revision":"79b4e91fa00e4b909e5d495a5fd038e4","observedAt":"2026-10-28T11:27:43.363+00:00","statement":{"source":"cve-program","id":"CVE-2026-99135","aliases":[],"title":"dm-integrity: fix infinite loop on discard with large tag size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix infinite loop on discard with large tag size\n\nWhen integrity_metadata handles a discard, it fills a buffer with\nDISCARD_FILLER and writes it over the tags, max_blocks blocks at a\ntime. If the kmalloc fails, the buffer is the on-stack array\nchecksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the\ntag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size\nis never decremented and the loop never terminates.\n\nFix this by using sizeof(checksums_onstack) as max_size. The array has\nMAX_TAG_SIZE bytes since commit b93b6643e9b5 (\"dm integrity: fix a\ncrash with unusually large tag size\"), so max_blocks is at least 1.","state":0,"publishedAt":"2026-10-28T10:34:47.902+00:00","modifiedAt":"2026-10-28T10:34:47.902+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-integrity.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"fc512700f1413fed652dac22fa1c4e837210b9c0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"251b44b424920df9204e88a81fb3f78fa48ddd99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"84597a44a9d86ac949900441cea7da0af0f2f473\",\n                            \"lessThan\": \"18d80c77b4c7dd20699e81cedfbbff4e9d198f28\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-integrity.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fc512700f1413fed652dac22fa1c4e837210b9c0","https://git.kernel.org/stable/c/251b44b424920df9204e88a81fb3f78fa48ddd99","https://git.kernel.org/stable/c/18d80c77b4c7dd20699e81cedfbbff4e9d198f28"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99135","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99135","identifiers":["CVE-2026-99135"]},"retained":false,"historicalAffected":[]}],"coverage":[]}