---
id: CVE-2026-90333
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-integrity: replace forgeable discard filler with a keyed sector marker

  The discard-block check in dm_integrity_rw_tag() treats a stored tag
  of all 0xf6 bytes (DISCA…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-integrity: replace forgeable discard filler with a keyed sector marker

  The discard-block check in dm_integrity_rw_tag() treats a stored tag
  of all 0xf6 bytes (DISCA…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    6228722c27304e4682cddc1fede03898f87e4414
  - >-
    Linux >= 84597a44a9d86ac949900441cea7da0af0f2f473 <
    68c5c42567bc462139128968ebbfadd0aefff519
  - Linux 5.7
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:31.830'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90333'
references:
  - url: 'https://git.kernel.org/stable/c/5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6228722c27304e4682cddc1fede03898f87e4414'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.819Z'
epss: 0.00206
epssPercentile: 0.09443
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: replace forgeable discard filler with a keyed sector marker

The discard-block check in dm_integrity_rw_tag() treats a stored tag
of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and
skips HMAC verification. allow_discards is only accepted in
dm-integrity's standalone mode. An attacker with raw write access to
the backing device, but without the integrity key, can stamp any block
with an all-0xf6 tag and have it served as authentic.

Add a new "allow_discards_keyed" target argument that marks discarded
blocks with a keyed checksum of (salt || sector) instead, computed by
integrity_discard_checksum().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.