CVE-2026-99135

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix infinite loop on discard with large tag size

When integrity metadata handles a discard, it fills a buffer with DISCARD FILLER and writes it over the tags, max blocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksums onstack and max size is set to HASH MAX DIGESTSIZE. So if the tag size is larger than HASH MAX DIGESTSIZE, max blocks is zero, bi size is never decremented and the loop never terminates.

Fix this by using sizeof(checksums onstack) as max size. The array has MAX TAG SIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so max blocks is at least 1.