Race condition in Linux kernel - CVE-2026-99136

Vulnerability details

The vulnerability allows a local user to cause failed encrypted storage operations to be reported as successful, potentially compromising data integrity.

The vulnerability exists due to a race condition in the Linux kernel dm-crypt crypt_dec_pending function when concurrent I/O completion updates the error status between its initial read and the final reference decrement. A local user can exploit this timing window to cause completion with a stale success status, masking a failed write or a failed read whose data was never decrypted.

Affected software

How to mitigate CVE-2026-99136

External References

• https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6
• https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8
• https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3

Related Security Bulletins

• Race condition in Linux kernel md driver
• Debian update for linux