CVE-2026-99098

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix buffer overflow in inline mode with large tag size

In inline mode, dm integrity check and dm integrity inline recheck compute the checksum of each block into an on-stack buffer of HASH MAX DIGESTSIZE bytes. integrity sector checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH MAX DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG STACKPROTECTOR the kernel panics in dm integrity check on the first read.

Enlarge both buffers to hold MAX TAG SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity metadata.

Note that this is not a security bug because the buffer overflow can only be triggered by root.