---
id: CVE-2026-98533
title: 'ipe: protect the dm-verity root hash with RCU'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipe: protect the dm-verity root hash with RCU

  ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes
  a new one on ->preresume, while policy evaluatio…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af <
    3bd335ed62444bec61201df7d368a0779e5bd300
  - >-
    Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af <
    599d0498a39319285afa908762e0c9fad29f772e
  - >-
    Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af <
    d7c5bd3159235edb0f2febe2cd3d3b0fb53986f1
  - >-
    Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af <
    2776e9c28513a1c855a94792b292cbcc533418c8
  - Linux 6.12
published: '2026-10-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:21:16.820Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98533'
references:
  - url: 'https://git.kernel.org/stable/c/3bd335ed62444bec61201df7d368a0779e5bd300'
  - url: 'https://git.kernel.org/stable/c/599d0498a39319285afa908762e0c9fad29f772e'
  - url: 'https://git.kernel.org/stable/c/d7c5bd3159235edb0f2febe2cd3d3b0fb53986f1'
  - url: 'https://git.kernel.org/stable/c/2776e9c28513a1c855a94792b292cbcc533418c8'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.279Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipe: protect the dm-verity root hash with RCU

ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes
a new one on ->preresume, while policy evaluation can still be
dereferencing it.

Protect the root hash with RCU. The evaluation path already runs under
rcu_read_lock().

[FW: remove model name according to latest guideline]

## Affected

- `Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af < 3bd335ed62444bec61201df7d368a0779e5bd300`
- `Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af < 599d0498a39319285afa908762e0c9fad29f772e`
- `Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af < d7c5bd3159235edb0f2febe2cd3d3b0fb53986f1`
- `Linux >= e155858dd99523d4afe0f74e9c26e4f4499eb5af < 2776e9c28513a1c855a94792b292cbcc533418c8`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.