{"api_version":"1","generated_at":"2026-09-18T01:06:22+00:00","cve":"CVE-2026-90052","urls":{"html":"https://cve.report/CVE-2026-90052","api":"https://cve.report/api/cve/CVE-2026-90052.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90052","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90052"},"summary":{"title":"dm-integrity: fix buffer overflow with keyed discard","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow with keyed discard\n\nSince commit 68c5c42567bc (\"dm-integrity: replace forgeable discard\nfiller with a keyed sector marker\"), integrity_metadata computes a\nchecksum for every discarded block into the \"checksums\" buffer.\nintegrity_sector_checksum always writes the whole digest. So if the tag\nsize is smaller than the digest size, the checksum of the last block\nthat fits into the buffer is written past the end of it. For example,\nwith hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past\nthe kmalloc'ed page.\n\nFix this by subtracting extra_space from the buffer size when computing\nmax_blocks, like we do for writes.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:16:53","updated_at":"2026-09-17 17:16:53"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/9988c1c9e0d1c78391e3d8e2817beb667470c76f","name":"https://git.kernel.org/stable/c/9988c1c9e0d1c78391e3d8e2817beb667470c76f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dd08a645195f410f2dcaa40de379a45ce110e873","name":"https://git.kernel.org/stable/c/dd08a645195f410f2dcaa40de379a45ce110e873","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/59e6f919d77d72ec79cbf171256f2f7819737580","name":"https://git.kernel.org/stable/c/59e6f919d77d72ec79cbf171256f2f7819737580","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90052","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90052","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775 9988c1c9e0d1c78391e3d8e2817beb667470c76f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6228722c27304e4682cddc1fede03898f87e4414 dd08a645195f410f2dcaa40de379a45ce110e873 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 68c5c42567bc462139128968ebbfadd0aefff519 59e6f919d77d72ec79cbf171256f2f7819737580 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.3-rc1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/dm-integrity.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9988c1c9e0d1c78391e3d8e2817beb667470c76f","status":"affected","version":"5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775","versionType":"git"},{"lessThan":"dd08a645195f410f2dcaa40de379a45ce110e873","status":"affected","version":"6228722c27304e4682cddc1fede03898f87e4414","versionType":"git"},{"lessThan":"59e6f919d77d72ec79cbf171256f2f7819737580","status":"affected","version":"68c5c42567bc462139128968ebbfadd0aefff519","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/dm-integrity.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.3-rc1"},{"lessThan":"7.3-rc1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc2","versionStartIncluding":"7.3-rc1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow with keyed discard\n\nSince commit 68c5c42567bc (\"dm-integrity: replace forgeable discard\nfiller with a keyed sector marker\"), integrity_metadata computes a\nchecksum for every discarded block into the \"checksums\" buffer.\nintegrity_sector_checksum always writes the whole digest. So if the tag\nsize is smaller than the digest size, the checksum of the last block\nthat fits into the buffer is written past the end of it. For example,\nwith hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past\nthe kmalloc'ed page.\n\nFix this by subtracting extra_space from the buffer size when computing\nmax_blocks, like we do for writes."}],"providerMetadata":{"dateUpdated":"2026-09-17T16:05:38.281Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/9988c1c9e0d1c78391e3d8e2817beb667470c76f"},{"url":"https://git.kernel.org/stable/c/dd08a645195f410f2dcaa40de379a45ce110e873"},{"url":"https://git.kernel.org/stable/c/59e6f919d77d72ec79cbf171256f2f7819737580"}],"title":"dm-integrity: fix buffer overflow with keyed discard","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90052","datePublished":"2026-09-17T16:05:38.281Z","dateReserved":"2026-09-11T19:38:34.783Z","dateUpdated":"2026-09-17T16:05:38.281Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:16:53","lastModifiedDate":"2026-09-17 17:16:53","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90052","Ordinal":"1","Title":"dm-integrity: fix buffer overflow with keyed discard","CVE":"CVE-2026-90052","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90052","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow with keyed discard\n\nSince commit 68c5c42567bc (\"dm-integrity: replace forgeable discard\nfiller with a keyed sector marker\"), integrity_metadata computes a\nchecksum for every discarded block into the \"checksums\" buffer.\nintegrity_sector_checksum always writes the whole digest. So if the tag\nsize is smaller than the digest size, the checksum of the last block\nthat fits into the buffer is written past the end of it. For example,\nwith hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past\nthe kmalloc'ed page.\n\nFix this by subtracting extra_space from the buffer size when computing\nmax_blocks, like we do for writes.","Type":"Description","Title":"dm-integrity: fix buffer overflow with keyed discard"}]}}}