SB2026102665 - Stack-based buffer overflow in Linux kernel md driver

Description

This security bulletin contains information about 1 vulnerability.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-99098)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in dm_integrity_check and dm_integrity_inline_recheck when computing block checksums in inline mode. A local privileged user can configure a tag size larger than HASH_MAX_DIGESTSIZE and trigger a read to cause checksum padding to overflow the on-stack digest buffer and cause a denial of service.

With CONFIG_STACKPROTECTOR enabled, the kernel panics in dm_integrity_check on the first read.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3c7aad85aeb9e28386672e3a009aa2e61f751b86
• https://git.kernel.org/stable/c/4f0ee735dc68e3e6c4dd9a666d7f7047163c4165
• https://git.kernel.org/stable/c/764b683a6180fd72c931c13fea98d383506a3475
• https://git.kernel.org/stable/c/f49cd7820cd0a96f20e1aa2708adb002124e38a7