Executive brief
The Linux kernel's dm-integrity module provides data integrity verification for storage devices using HMAC signatures. An attacker with raw write access to the backing storage device—but without the integrity key—can forge block discard markers to bypass HMAC verification and serve unauthentic data as verified. This allows silent data corruption or injection of malicious data on systems using dm-integrity with discards enabled.
Technical details
The vulnerability exists in dm-integrity's discard handling mechanism within dm_integrity_rw_tag(). The code treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as definitive proof that a block was discarded and unconditionally skips HMAC verification. An unauthenticated attacker with raw write access to the backing device can stamp any block with this fixed pattern, forcing the kernel to treat it as a legitimate discard without cryptographic verification. The attack requires allow_discards to be enabled in standalone mode. The fix introduces "allow_discards_keyed" mode, which marks discards with a keyed checksum of (salt || sector) computed via integrity_discard_checksum(), making forgery impossible without knowledge of the integrity key.
Affected products
- Linux Linux kernel multiple versions with dm-integrity module (fix backported across all stable series)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix committed to stable Linux kernel branches by Greg Kroah-Hartman