In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: replace forgeable discard filler with a keyed sector marker
The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and skips HMAC verification. allow_discards is only accepted in dm-integrity's standalone mode. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with an all-0xf6 tag and have it served as authentic.
Add a new "allow_discards_keyed" target argument that marks discarded blocks with a keyed checksum of (salt || sector) instead, computed by integrity_discard_checksum().
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18Upgrade kernel6.18-debuginfo-common-aarch64Upgrade perf6.18Upgrade kernel6.18-toolsUpgrade microvm-kernel6.18Upgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-modules-extraUpgrade bpftool6.18Upgrade kernel6.18-headersUpgrade python3-perf6.18-debuginfoUpgrade bpftool6.18-debuginfoUpgrade python3-perf6.18Upgrade perf6.18-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel-livepatch-6.18.54-121.166Upgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-develUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-debuginfo | Oct 13, 2026 | Sep 17, 2026 |
| Redhat_linux | — | No solution exists | Oct 5, 2026 | Sep 17, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub