CVE Intelligence
Unknown

CVE-2026-99086 — dm-integrity: validate the superblock on resume

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor validates the superblock it reads and sizes all the in-memory structures according to it. The user may modify the superblock on the underlying device while the dm-integrity device is suspended, so that the two no longer agree. In particular, access_journal_data() shifts the journal entry index by ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the journal page list were computed with the value that was present at constructor time. Increasing log2_sectors_per_block makes the index run past the end of the journal, and dm-integrity then writes 512 bytes through lowmem_page_address(NULL). Snapshot the validated superblock in the constructor and refuse to resume if any of the fields that describe the on-disk geometry changed.

Published Oct 23, 2026 · Updated Oct 23, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • No scoring signals.

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
—
No EPSS score.
Affects
Linux
Linux
CVSS base
—
Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
  2. No fix documented in the sources: reduce exposure and monitor the vendor advisory.
  3. Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Linux Linux ≥ 38625191f32f77a9d5fc7cc15f4f9b78768bfb33 and < 454b67fcc28c18502e47dfb9f067b04c28628ada≥ 118ba36e446c01e3cd34b3eedabf1d9436525e1d and < e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e≥ 118ba36e446c01e3cd34b3eedabf1d9436525e1d and < fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2version 824b9c27d7b600520b95f0cab95a47d1b08a9483version fb49f209995f729053c6ee728436f98d78a49b6fversion c6138af1f5454c2631a837916fda958ea72c0d71version 3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f≥ 6.18.16 and < 6.18.58
and 5 more ≥ 6.1.165 and < 6.2≥ 6.6.128 and < 6.7≥ 6.12.75 and < 6.13≥ 6.19.6 and < 6.20version 7.0
Vulnerable CVE Program (cve.org) e CISA ADP

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Not enough vector or weakness data: use the affected application’s logs as a starting point.
application logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Record published
    Oct 23, 2026
  • Affected products added · linux/linux
    Oct 23, 2026 · CVE Program (cve.org) e CISA ADP
  • Source status changed · → Received
    Oct 23, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 23, 2026 · Alertas do Telegram
  • CVE published
    Oct 23, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

  • 1× References added · Oct 23, 2026 – Oct 23, 2026
  • 1× Official description updated · Oct 23, 2026 – Oct 23, 2026

References

3 on the record

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

  • CVE-2026-99087 dm-integrity: fix NULL pointer dereference when the 'R' flag is used 9h
  • CVE-2026-99079 net/mlx5e: Prevent stale XSK buffer release on refill retry 9h
  • CVE-2026-99080 fs: Free any excess xarray nodes in clear_inode() 9h
  • CVE-2026-99081 bnxt_en: fix DMA mapping length for padded small packets 9h
  • CVE-2026-99082 KVM: x86: Use active memslots for the per-vCPU MMIO cache 9h
  • CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate() 9h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No CVSS score published by NVD, the CNA, CISA or GitHub so far.
  • No FIRST EPSS score.
  • No fixed version, patch or mitigation documented.
  • No CISA SSVC assessment.
  • No CWE classification.
  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-99086 is "dm-integrity: validate the superblock on resume", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.