---
id: CVE-2026-72099
title: 'dm-integrity: don''t increment hash_offset twice'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-integrity: don't increment hash_offset twice

  hash_offset is already incremented in the loop "for (i = 0; i < to_copy;
  i++, ts--)". Do not increment it again.
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    c66b1781a54984227e94b862be9328d81d81e51c
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    39697e2759ac23e65361fe61482f8174cad8a752
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    e6646f4d711d74930d39cce6fb7bfcae4cbee5fd
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    cf9feed8c131e303ecf2afebe6f791be018818ad
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    4f4e43337e9ef322595201cfc24def50fd624219
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    5dfd8042635278613da3b88553e25ade2103cd58
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    829476c06496aab018f14127c055adb164d1a750
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    edf025f083854f80032b73a1aad69a3c90db236f
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:51:53.051059Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:20.840Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72099'
references:
  - url: 'https://git.kernel.org/stable/c/c66b1781a54984227e94b862be9328d81d81e51c'
  - url: 'https://git.kernel.org/stable/c/39697e2759ac23e65361fe61482f8174cad8a752'
  - url: 'https://git.kernel.org/stable/c/e6646f4d711d74930d39cce6fb7bfcae4cbee5fd'
  - url: 'https://git.kernel.org/stable/c/cf9feed8c131e303ecf2afebe6f791be018818ad'
  - url: 'https://git.kernel.org/stable/c/4f4e43337e9ef322595201cfc24def50fd624219'
  - url: 'https://git.kernel.org/stable/c/5dfd8042635278613da3b88553e25ade2103cd58'
  - url: 'https://git.kernel.org/stable/c/829476c06496aab018f14127c055adb164d1a750'
  - url: 'https://git.kernel.org/stable/c/edf025f083854f80032b73a1aad69a3c90db236f'
tags:
  - cve.org
epss: 0.00546
epssPercentile: 0.44578
ingestedAt: '2026-10-16T17:24:46.879Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: don't increment hash_offset twice

hash_offset is already incremented in the loop "for (i = 0; i < to_copy;
i++, ts--)". Do not increment it again.

## Affected

- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < c66b1781a54984227e94b862be9328d81d81e51c`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < 39697e2759ac23e65361fe61482f8174cad8a752`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < e6646f4d711d74930d39cce6fb7bfcae4cbee5fd`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < cf9feed8c131e303ecf2afebe6f791be018818ad`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < 4f4e43337e9ef322595201cfc24def50fd624219`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < 5dfd8042635278613da3b88553e25ade2103cd58`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < 829476c06496aab018f14127c055adb164d1a750`
- `Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 < edf025f083854f80032b73a1aad69a3c90db236f`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.