CVE-2026-90333

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: replace forgeable discard filler with a keyed sector marker

The discard-block check in dm_integrity_rw_tag() treats a stored tag

of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and

skips HMAC verification. allow_discards is only accepted in

dm-integrity's standalone mode. An attacker with raw write access to

the backing device, but without the integrity key, can stamp any block

with an all-0xf6 tag and have it served as authentic.

Add a new "allow_discards_keyed" target argument that marks discarded

blocks with a keyed checksum of (salt || sector) instead, computed by

integrity_discard_checksum().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References