Executive brief
Debian live-boot is a system used to boot and manage live Linux systems from removable media. When the optional .verity file is deleted from the boot medium, the system ignores all dm-verity integrity protection settings configured via kernel parameters, allowing an attacker to modify the filesystem without detection. This can defeat security protections like signed root hash verification even in Secure Boot environments.
Technical details
The vulnerability is a logic error in live-boot's dm-verity initialization code. The initramfs parses dm-verity kernel command-line parameters (dm-verity-enforce-roothash-signature, dm-verity-oncorruption, dm-verity-root-hash) during boot, but only applies them if a .verity file exists on the filesystem. An attacker with access to the block device can delete the .verity file, causing the system to boot without dm-verity protection regardless of kernel parameters. The dm_verity kernel module is never loaded when no .verity file is present, bypassing even kernel-level signature enforcement. This affects all live-boot versions from 1:20220505 onwards. The fix requires live-boot to validate dm-verity file presence or hash consistency regardless of .verity file existence, or to fail safely when dm-verity parameters are set but cannot be enforced.
Affected products
- Debian live-boot 1:20220505 through at least 1:20230131+deb12u1
Timeline
- 2026-09-01: disclosed: Bug reported to Debian Bug Tracking System
- 2026-09-11: advisory: CVE-2026-89169 published on NVD