---
id: CVE-2026-99098
title: 'dm-integrity: fix buffer overflow in inline mode with large tag size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-integrity: fix buffer overflow in inline mode with large tag size

  In inline mode, dm_integrity_check and dm_integrity_inline_recheck
  compute the checksum of each bl…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 <
    3c7aad85aeb9e28386672e3a009aa2e61f751b86
  - >-
    Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 <
    4f0ee735dc68e3e6c4dd9a666d7f7047163c4165
  - >-
    Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 <
    f49cd7820cd0a96f20e1aa2708adb002124e38a7
  - >-
    Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 <
    764b683a6180fd72c931c13fea98d383506a3475
  - Linux 6.11
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:52:04.416Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99098'
references:
  - url: 'https://git.kernel.org/stable/c/3c7aad85aeb9e28386672e3a009aa2e61f751b86'
  - url: 'https://git.kernel.org/stable/c/4f0ee735dc68e3e6c4dd9a666d7f7047163c4165'
  - url: 'https://git.kernel.org/stable/c/f49cd7820cd0a96f20e1aa2708adb002124e38a7'
  - url: 'https://git.kernel.org/stable/c/764b683a6180fd72c931c13fea98d383506a3475'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.505Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix buffer overflow in inline mode with large tag size

In inline mode, dm_integrity_check and dm_integrity_inline_recheck
compute the checksum of each block into an on-stack buffer of
HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
with zeroes up to the tag size, so if the tag size is larger than
HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
first read.

Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
("dm integrity: fix a crash with unusually large tag size") did for
integrity_metadata.

Note that this is not a security bug because the buffer overflow can only
be triggered by root.

## Affected

- `Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 < 3c7aad85aeb9e28386672e3a009aa2e61f751b86`
- `Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 < 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165`
- `Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 < f49cd7820cd0a96f20e1aa2708adb002124e38a7`
- `Linux >= fb0987682c629c1d2c476f35f6fde405a5e304a4 < 764b683a6180fd72c931c13fea98d383506a3475`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.