Not yet scoredPublished Oct 23, 2026

CVE-2026-99087dm-integrity: fix NULL pointer dereference when the 'R' flag is used

Updated under an hour ago (Oct 27, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm_integrity_resume happens because the function attempts to read the journal containing the bitmap. This patch makes dm-integrity skip any writes to the device in dm_integrity_resume if the device is activated in the 'R' mode.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 23, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	468dfca38b1a6fbdccd195d875599cb7c8875cd9 builds before 2e25842f0e4423e0efb243f56153d842ed6b933f; 468dfca38b1a6fbdccd195d875599cb7c8875cd9 builds before 69ed43ed8a174465fca1ba6bfbde53e4618c8956; 468dfca38b1a6fbdccd195d875599cb7c8875cd9 builds before 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84	CNA record

References

References

https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f
https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956
https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.