# CVE-2026-99086: Linux kernel dm-integrity superblock validation bypass

Source: https://junglewise.ai/threats/cve-2026-99086-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-99086 · Severity: info · Published 2026-10-23

The Linux kernel's dm-integrity subsystem, which protects data integrity for virtual storage volumes, fails to validate the superblock when resuming a device. An attacker with local access to the underlying storage device can modify the superblock while the volume is suspended, then cause the driver to write data to arbitrary kernel memory when the device resumes, potentially achieving code execution.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-99086 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99086 being exploited in the wild.

**How severe is CVE-2026-99086?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Linux Kernel affected versions prior to fix commit fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2.

**Is there a fix for CVE-2026-99086?** Yes: fixed in Linux kernel versions with commit fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2 and later. Until then: Restrict write access to underlying storage devices backing dm-integrity volumes to trusted users only. Use access controls to prevent unauthorized modification of storage device superblocks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-99086 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99086?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Linux kernel versions with commit fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2 and later

Restrict write access to underlying storage devices backing dm-integrity volumes to trusted users only. Use access controls to prevent unauthorized modification of storage device superblocks.

## Technical details

The dm_integrity_resume() function re-reads the superblock from disk without validating that its geometry parameters match the values that were validated at driver initialization. A local attacker can modify the superblock on the underlying device (particularly the log2_sectors_per_block field) while dm-integrity is suspended. Upon resume, this causes journal entry index calculations to run past the end of the allocated journal buffer, resulting in an out-of-bounds write via lowmem_page_address(NULL). The fix snapshots the validated superblock at construction and rejects resume if geometry fields have changed.

## Affected products

- Linux Linux kernel affected versions prior to fix commit fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2

## Timeline

- 2026-10-23: disclosed

## References

- [https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada](https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada)
- [https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e](https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)