Look up another CVE · open CVE-2026-72100 in the interactive tracker
CVE-2026-72100
dm-integrity: fix a bug if the bio is out of limits
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/md. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72100 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
If dm_integrity_check_limits fails, the code would exit with DM_MAPIO_KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a deadlock. Let's move the limit check up, so that when it exits, no resources are leaked.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/md/dm-integrity.c
- What this is
- DEVICE-MAPPER (LVM)MAINTAINERS section matched on drivers/md/dm* · dm-devel@lists.linux.dev · Maintained
- Kernel module
- dm_integrity
Check it on the machine
grep -wE 'CONFIG_DM_INTEGRITY|CONFIG_MD' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w dm_integrityPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_DM_INTEGRITY, CONFIG_MD
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.60%, higher than 47.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/md
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.11 | 6.12.97 | f7989286175f |
| 6.11 | 6.18.40 | aa5113e7155f |
| 6.11 | 7.1.5 | 3d1afaa07462 |
| 6.11 | 7.2 | 5a266764fada |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is hit in dm_integrity_map_inline() on block I/O to dm-integrity inline volumes; in enterprise/cloud deployments those volumes are commonly exported over network block protocols (iSCSI, NVMe-oF, NBD), letting a remote initiator drive the vulnerable map path.
- AC:LAttack complexity, low
- During SB_FLAG_RECALCULATING the attacker can reliably issue concurrent I/O ahead of the recalc cursor that fails dm_integrity_check_limits (e.g., block-aligned totals with misaligned bvecs), acquiring integrity_range_locked before DM_MAPIO_KILL without cleanup.
- PR:LPrivileges required, low
- Exploitation requires submitting crafted block I/O to the dm-integrity device—available to unprivileged users with device access (disk group), CAP_SYS_ADMIN in a user namespace that can create dm targets, or authenticated remote block-storage clients—not fully unauthenticated network access.
- UI:NUser interaction, none
- Triggering the flaw needs only attacker-initiated block I/O during recalculation; no victim interaction such as opening files or mounting filesystems is required.
- S:UScope, unchanged
- Impact is kernel heap corruption, deadlock, and privilege escalation within the host kernel security domain; it does not cross a VM/hypervisor or IOMMU boundary.
- C:HConfidentiality impact, high
- On DM_MAPIO_KILL the dm core frees the bio/per-io dm_integrity_io while dio->range remains in ic->in_progress, creating a use-after-free that can be leveraged for arbitrary kernel memory disclosure via subsequent tree walks.
- I:HIntegrity impact, high
- The dangling dm_integrity_range node in the red-black tree enables heap metadata corruption and attacker-controlled reuse of freed dm_integrity_io memory, supporting arbitrary kernel write and local privilege escalation.
- A:HAvailability impact, high
- The leaked range lock permanently blocks overlapping I/O (uninterruptible waits/deadlock), and UAF on in_progress tree operations can cause kernel oops/panic, producing severe and persistent loss of availability.