248 lines
12 KiB
JSON
248 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-99135",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.394Z",
|
|
"datePublished": "2026-10-28T10:34:47.902Z",
|
|
"dateUpdated": "2026-10-30T12:42:08.647Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:42:08.647Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix infinite loop on discard with large tag size\n\nWhen integrity_metadata handles a discard, it fills a buffer with\nDISCARD_FILLER and writes it over the tags, max_blocks blocks at a\ntime. If the kmalloc fails, the buffer is the on-stack array\nchecksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the\ntag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size\nis never decremented and the loop never terminates.\n\nFix this by using sizeof(checksums_onstack) as max_size. The array has\nMAX_TAG_SIZE bytes since commit b93b6643e9b5 (\"dm integrity: fix a\ncrash with unusually large tag size\"), so max_blocks is at least 1."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/md/dm-integrity.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "f41a224b3c9d66c7b59afc7cae02a8b214f3c684",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "c66f5c6ccfa832d28b44a66c01e3468c246adac4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "41a18e6c6e2c4a912494a035c17ecfe79c68b9e6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "bbc154a7da4e075aef720ef051aff6094400eb66",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "c4cba6670fa199415689f67108e96b0ba469d767",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "fc512700f1413fed652dac22fa1c4e837210b9c0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "251b44b424920df9204e88a81fb3f78fa48ddd99",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
|
|
"lessThan": "18d80c77b4c7dd20699e81cedfbbff4e9d198f28",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/md/dm-integrity.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.7",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.7",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.273",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.224",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.161",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.115",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.59",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.13",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "5.10.273"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "5.15.224"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.6.161"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.12.115"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.18.59"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "7.2.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f41a224b3c9d66c7b59afc7cae02a8b214f3c684"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c66f5c6ccfa832d28b44a66c01e3468c246adac4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/41a18e6c6e2c4a912494a035c17ecfe79c68b9e6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bbc154a7da4e075aef720ef051aff6094400eb66"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c4cba6670fa199415689f67108e96b0ba469d767"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fc512700f1413fed652dac22fa1c4e837210b9c0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/251b44b424920df9204e88a81fb3f78fa48ddd99"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/18d80c77b4c7dd20699e81cedfbbff4e9d198f28"
|
|
}
|
|
],
|
|
"title": "dm-integrity: fix infinite loop on discard with large tag size",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |