CVE-2026-99087: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99087 is a NULL pointer dereference vulnerability in the Linux kernel's dm-integrity subsystem. It occurs when a dm-integrity device with the SB_FLAG_DIRTY_BITMAP flag set is activated in read-only ('R') mode, causing a kernel crash in dm_integrity_resume as the function incorrectly attempts to read the journal containing the bitmap. The vulnerability was published on October 23, 2026, and affects Linux kernel versions from 5.2 onward up to the patched releases. The CVSS score has not been formally assigned, but the severity is estimated as Medium (GitHub Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the dm_integrity_resume function within the Linux kernel's device-mapper integrity target. When a dm-integrity device has SB_FLAG_DIRTY_BITMAP set and is activated in 'R' (read-only) mode, the resume function attempts to process the journal bitmap as if the device were writable, dereferencing a NULL pointer and triggering a kernel panic. The fix modifies dm_integrity_resume to skip any write operations when the device is in read-only mode, preventing the erroneous journal access. Exploitation requires local access and the ability to configure and activate dm-integrity devices (GitHub Advisory).

Successful exploitation causes a kernel crash (NULL pointer dereference), resulting in a complete denial of service — the affected system becomes unavailable until rebooted. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise. The vulnerability requires local access, limiting its scope to systems where an attacker already has the ability to activate dm-integrity devices (Feedly, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and specific device configuration (dm-integrity device with SB_FLAG_DIRTY_BITMAP set), significantly limiting the attack surface.

Patches are available in Linux kernel stable branches: commit 2e25842f0e4423e0efb243f56153d842ed6b933f, 69ed43ed8a174465fca1ba6bfbde53e4618c8956, and 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84 (GitHub Advisory). Fixed versions include 6.18.58, 7.2.12, and 7.3 and later. As a workaround, administrators should avoid activating dm-integrity devices that have the SB_FLAG_DIRTY_BITMAP flag set in read-only ('R') mode until the patch is applied.