block: zero non-PI portion of auto integrity buffer (Linux Linux)

CVE-2026-23007
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.20 % · percentile 10 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise the uninitialized memory can be read back by userspace or anyone with physical access to the storage device. If protection information is generated, that portion of the integrity buffer is already initialized. The integrity data is also zeroed if PI generation is disabled via sysfs or the PI tuple size is 0. However, this misses the case where PI is generated and the PI tuple size is nonzero, but the metadata size is larger than the PI tuple. In this case, the remainder ("opaque") of the metadata is left uninitialized. Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the metadata is larger than just the PI tuple.

Weaknesses (CWE)

  • CWE-908 — Use of Uninitialized Resource

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected c546d6f438338017480d105ab597292da67f6f6a < 765bf0a5880777c04ae98fc2a9f3b995737b3a64 ; affected c546d6f438338017480d105ab597292da67f6f6a < d6072557b90e0c557df319a56f4a9dc482706d2c ; affected c546d6f438338017480d105ab597292da67f6f6a < ca22c566b89164f6e670af56ecc45f47ef3df819
Linux · Linuxaffected 6.11 ; unaffected 0 < 6.11 ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.7 ≤ 6.18.* ; unaffected 6.19 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD