CVE-2026-99087 Linux CVE debrief

Who should care

Linux administrators, security teams, and developers using dm-integrity with the 'R' flag should assess exposure and prioritize verification of affected systems, especially those with potential system crashes or instability. They should review system configurations, update to fixed versions if necessary, and monitor system logs for potential errors related to dm_integrity_resume.

Why it matters

Linux administrators and security teams should assess exposure and prioritize verification of affected systems, especially those using dm-integrity with the 'R' flag, due to potential system crashes or instability.

• Potential system crashes or instability when using dm-integrity with the 'R' flag
• Need for verification of affected system configurations and updates to fixed versions
• Importance of monitoring system logs for potential errors related to dm_integrity_resume

Technical summary

The Linux kernel's dm-integrity module is vulnerable to a NULL pointer dereference when the 'R' flag is used. This occurs when the device has the SB_FLAG_DIRTY_BITMAP flag set and is activated in 'R' mode, causing a crash in dm_integrity_resume. The fix skips writes to the device in dm_integrity_resume if it's activated in 'R' mode. Affected Linux administrators and security teams should assess exposure and prioritize verification of affected systems, especially those using dm-integrity with the 'R' flag, due to potential system crashes or instability.

Defensive priority

Linux administrators and security teams should assess exposure and prioritize verification of affected systems, especially those using dm-integrity with the 'R' flag.

Recommended defensive actions

• Assess exposure of Linux systems using dm-integrity with the 'R' flag
• Verify system configurations and update to fixed versions if necessary
• Monitor system logs for potential crashes or errors related to dm_integrity_resume
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix. However, specific version ranges and detailed exploitation scenarios require verification from official Linux sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.