CVE-2026-99136

Last refreshed2026-10-31

Status: UPDATED | Advisory ID: CVE-2026-99136

Key Details

CVE	CVE-2026-99136
CVSS Score / Version	7.0 (High) / CVSS v3.1
Updated	2026-10-31
CVSS Vector	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is high; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: fix a tiny race condition in crypt_dec_pending

crypt_dec_pending reads io->error before calling atomic_dec_and_test.

Another context, for example crypt_endio called from an interrupt, may

set io->error and drop its reference between the read and the

decrement. crypt_dec_pending then drops the last reference and completes

the bio with the stale status - so a read that failed and was never

decrypted, or a write that failed, is reported as successful.

The read was placed before the decrement by commit b35f8caa0890 ("dm

crypt: wait for endio to complete before destruction"), because that

commit freed dm_crypt_io before calling bio_endio. This is no longer the

case, dm_crypt_io lives in the per-bio data now.

Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is

fully ordered, so no additional barrier is needed. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-99136
CVE	https://www.cve.org/CVERecord?id=CVE-2026-99136

Source

Reference

NVD

CVE