SB2026102373 - NULL pointer dereference in Linux kernel md driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99086)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to insufficient validation of superblock geometry in dm_integrity_resume() when reloading the superblock after a device suspension. A local privileged user can increase log2_sectors_per_block on the underlying device while the dm-integrity device is suspended to make journal indexing exceed the allocated journal structures after resume, triggering a 512-byte write through lowmem_page_address(NULL) and causing a kernel crash.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada
• https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e
• https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2