GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
CVE-2026-99098unknown

dm-integrity: fix buffer overflow in inline mode with large tag size

Impact

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Linux · Linux

Other versions: unaffected

Version / rangeSource status
fb0987682c629c1d2c476f35f6fde405a5e304a4 to before 3c7aad85aeb9e28386672e3a009aa2e61f751b86affected
fb0987682c629c1d2c476f35f6fde405a5e304a4 to before 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165affected
fb0987682c629c1d2c476f35f6fde405a5e304a4 to before f49cd7820cd0a96f20e1aa2708adb002124e38a7affected
fb0987682c629c1d2c476f35f6fde405a5e304a4 to before 764b683a6180fd72c931c13fea98d383506a3475affected
Linux version evidence

Linux · Linux

Other versions: affected

Version / rangeSource status
6.11affected
0 to before 6.11unaffected
6.12.114 through 6.12.* (inclusive)unaffected
6.18.57 through 6.18.* (inclusive)unaffected
7.2.11 through 7.2.* (inclusive)unaffected
7.3 through * (inclusive)unaffected
Linux version evidence

Original source description

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix buffer overflow in inline mode with large tag size

In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read.

Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata.

Note that this is not a security bug because the buffer overflow can only be triggered by root.

References