Is there a patch available for CVE-2026-99098?

Yes, a patch is available for CVE-2026-99098. Update the affected software to the latest version immediately.

Linux CVE-2026-99098

EUVD-2026-109904

2026-10-26 Linux

GHSA-wfqx-5v3g-mpcg

Buffer Overflow Linux

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix buffer overflow in inline mode with large tag size

In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read.

Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata.

Note that this is not a security bug because the buffer overflow can only be triggered by root.

Affected VersionsENISA

Linux patch: 0

Linux patch: 7.3

Linux fb0987682c629c1d2c476f35f6fde405a5e304a4 <3c7aad85aeb9e28386672e3a009aa2e61f751b86

Linux fb0987682c629c1d2c476f35f6fde405a5e304a4 <f49cd7820cd0a96f20e1aa2708adb002124e38a7

Linux fb0987682c629c1d2c476f35f6fde405a5e304a4 <764b683a6180fd72c931c13fea98d383506a3475

Linux fb0987682c629c1d2c476f35f6fde405a5e304a4 <4f0ee735dc68e3e6c4dd9a666d7f7047163c4165

Linux patch: 6.12.114

Linux patch: 6.18.57

Linux patch: 7.2.11

Linux 6.11

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 26, 2026 - 16:17 EUVD

CVE Published

Oct 26, 2026 - 14:52 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Social Media

Sightings

Data Quality

1 sources

Confidence: Low

EUVD

CVE.org

EPSS CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.