Linux Kernel CVE-2026-72099

dm-integrity is a Linux kernel device mapper target (drivers/md/dm-integrity.c) that provides block-level data integrity verification, storing cryptographic hashes alongside data sectors on storage devices. The vulnerability is a loop-counter double-increment: hash_offset is already advanced within the for-loop construct 'for (i = 0; i < to_copy; i++, ts--)' via implicit pointer arithmetic, but the code then increments hash_offset again explicitly outside or redundantly within the loop body. The root cause class is a logic error (the listed CWE is N/A, though CWE-682 Incorrect Calculation or CWE-193 Off-by-One Error would apply). This causes dm-integrity to read or write hashes at wrong offsets, breaking the integrity guarantee the subsystem is specifically designed to provide. The 'Information Disclosure' tag in source intelligence is inconsistent with the CVSS C:N metric - this discrepancy should be verified, as wrong-offset hash reads could theoretically expose adjacent hash data.