SB20260816424 - Improper Initialization in Linux kernel md driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-72101)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in dm-integrity when processing integrity metadata with a hash size smaller than the device tuple size. A local user can trigger integrity processing to disclose sensitive information.

The issue occurs because remaining tuple bytes are not zeroed as intended when the hash size is less than the tuple size, which can leak uninitialized kernel memory.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0c4e9bb1d4101030f55c869f18bd3ece39a77bbb
• https://git.kernel.org/stable/c/50af3e51dc709384701dbc721b4bd865285c5f2c
• https://git.kernel.org/stable/c/7bb03b2b01b814a9fc14afbfc2cbb2cca5b34750
• https://git.kernel.org/stable/c/8f0af8493009a61b4313e0a8c6e03fbc36fd43f9