CVE-2026-99098: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99098 is a stack-based buffer overflow vulnerability in the Linux kernel's dm-integrity subsystem, specifically in inline mode when a large tag size is configured. In dm_integrity_check and dm_integrity_inline_recheck, checksums are computed into an on-stack buffer sized HASH_MAX_DIGESTSIZE bytes; if the configured tag size exceeds this, the zero-padding performed by integrity_sector_checksum writes past the end of the buffer, causing a kernel panic when CONFIG_STACKPROTECTOR is enabled. The vulnerability was published on October 26, 2026, and affects Linux kernel 6.11 through versions prior to the fixes backported into 6.12.114, 6.18.57, and 7.2.11. The CVSS base score is reported as 0.0 (the kernel maintainers explicitly note this is not a security bug because exploitation requires root privileges), with Feedly estimating a Medium severity (GitHub Advisory, Feedly).

The root cause is a classic stack-based buffer overflow (CWE-121) in the dm-integrity kernel module's inline mode. The functions dm_integrity_check and dm_integrity_inline_recheck allocate an on-stack buffer of HASH_MAX_DIGESTSIZE bytes to hold block checksums; however, integrity_sector_checksum pads its output with zeroes up to the configured tag size. When the tag size exceeds HASH_MAX_DIGESTSIZE, this padding operation writes beyond the buffer boundary. The fix mirrors commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), which addressed the same class of bug in integrity_metadata, by enlarging both affected buffers to MAX_TAG_SIZE bytes. Exploitation requires local root access to configure a dm-integrity device with an unusually large tag size and then trigger a read operation (GitHub Advisory, Feedly).

The primary impact is a kernel panic (denial of service) on systems with CONFIG_STACKPROTECTOR enabled, triggered on the first read from a dm-integrity device configured with a tag size larger than HASH_MAX_DIGESTSIZE. In theory, the stack buffer overflow could also allow a local attacker with root privileges to execute arbitrary code at the kernel level, though the kernel maintainers classify this as a stability bug rather than a security vulnerability given the root-only precondition. Availability is the most realistic concern in practice, as the kernel panic would crash the affected system (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting the extremely low probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained to local attackers with root privileges who can configure a dm-integrity device with an unusually large tag size, making weaponization highly unlikely in real-world environments (GitHub Advisory).

Apply the kernel patches that enlarge the on-stack buffers in dm_integrity_check and dm_integrity_inline_recheck to MAX_TAG_SIZE bytes. Fixed versions are available in Linux kernel 6.12.114, 6.18.57, 7.2.11, and 7.3+. The fix commits are 3c7aad85aeb9, 4f0ee735dc68, f49cd7820cd0, and 764b683a6180. As a workaround prior to patching, avoid configuring dm-integrity devices with tag sizes larger than HASH_MAX_DIGESTSIZE, or restrict root access to prevent unauthorized dm-integrity configuration (GitHub Advisory, Feedly).

The kernel maintainers explicitly noted in the commit message that this is not a security bug because the buffer overflow can only be triggered by root, which has kept community attention minimal. No notable researcher commentary or significant media coverage has been identified beyond standard CVE tracking and aggregator sites (GitHub Advisory).