CVE-2026-99086: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99086 is a Linux kernel vulnerability in the dm-integrity subsystem where the dm_integrity_resume() function re-reads the on-disk superblock without validating it, enabling out-of-bounds memory writes that can lead to arbitrary code execution. The flaw was published on October 23, 2026, and affects multiple stable kernel branches: 6.1.165–6.2, 6.6.128–6.7, 6.12.75–6.13, 6.18.16–6.18.58, 6.19.6–6.20, and version 7.0. A patch is available. The CVSS base score is currently listed as 0.0 (severity estimate: Medium) with an EPSS score of 0.0, reflecting early-stage scoring (Github Advisory, Feedly).

The root cause is a missing input validation step (CWE not formally assigned) in dm_integrity_resume(): the constructor validates the superblock and sizes all in-memory structures accordingly, but the resume path re-reads the superblock from the underlying block device without re-validating it. A local user with write access to the underlying block device can modify the log2_sectors_per_block field in the superblock while the dm-integrity device is suspended. When the device resumes, access_journal_data() uses the tampered log2_sectors_per_block value to shift the journal entry index, causing it to run past the end of the allocated journal buffer. This results in dm-integrity writing 512 bytes through lowmem_page_address(NULL) — a NULL-pointer-derived address — enabling an out-of-bounds memory write. The fix snapshots the validated superblock in the constructor and refuses to resume if any geometry-describing fields have changed (Github Advisory).

A local attacker with write access to the underlying block device can trigger an out-of-bounds memory write of 512 bytes through a NULL-derived address, potentially enabling arbitrary code execution with kernel privileges. Successful exploitation could result in full system compromise, including privilege escalation, data corruption, or denial of service. The attack is limited to local access scenarios where the attacker can both write to the block device and control the suspend/resume lifecycle of the dm-integrity device (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and the ability to write to the underlying block device while the dm-integrity device is suspended, significantly limiting the attacker pool. No threat actor attribution has been reported.

1. Gain local access: Obtain a local account on the target system with write access to the underlying block device used by a dm-integrity device (e.g., /dev/sdX).
2. Suspend the dm-integrity device: Use dmsetup suspend <device> to suspend the dm-integrity target, causing it to flush state but remain configured in memory.
3. Modify the superblock: Directly write to the underlying block device to alter the log2_sectors_per_block field in the dm-integrity superblock to a larger value (e.g., using dd or a custom binary tool targeting the known superblock offset).
4. Resume the dm-integrity device: Execute dmsetup resume <device> to trigger dm_integrity_resume(), which re-reads the tampered superblock without validation.
5. Trigger out-of-bounds write: Perform I/O operations on the dm-integrity device to invoke access_journal_data(), which uses the inflated log2_sectors_per_block to compute an out-of-bounds journal index, causing a 512-byte write through lowmem_page_address(NULL) and potentially achieving kernel-level arbitrary code execution (Github Advisory, Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing unexpected dm-integrity resume errors, NULL pointer dereferences, or BUG/OOPS traces originating from dm-integrity.c or access_journal_data().
• Process/System Behavior: Unexpected dmsetup suspend or dmsetup resume commands executed by non-root or non-administrative users; unusual direct block device writes (e.g., dd targeting a device backing a dm-integrity volume).
• File System: Unexpected modifications to the raw block device underlying a dm-integrity device, detectable via block-level integrity monitoring tools.
• Kernel: Kernel crash dumps (vmcore) or panic logs referencing lowmem_page_address(NULL) or out-of-bounds journal access in the dm-integrity subsystem.

Update the Linux kernel to a patched version: 6.1.x users should upgrade past 6.2, 6.6.x users past 6.7, 6.12.x users past 6.13, 6.18.x users to 6.18.58 or later, 6.19.x users to 6.20 or later, and 7.0 users to 7.2.12 or 7.3+. Patch commits are available at the kernel stable tree (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). As interim mitigations: restrict write access to underlying block devices used by dm-integrity, avoid suspending dm-integrity devices in environments where the block device may be accessed by untrusted users, and monitor dm-integrity resume operations for anomalies (Feedly).