CVE-2026-23007

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: zero non-PI portion of auto integrity buffer

The auto-generated integrity buffer for writes needs to be fully

initialized before being passed to the underlying block device,

otherwise the uninitialized memory can be read back by userspace or

anyone with physical access to the storage device. If protection

information is generated, that portion of the integrity buffer is

already initialized. The integrity data is also zeroed if PI generation

is disabled via sysfs or the PI tuple size is 0. However, this misses

the case where PI is generated and the PI tuple size is nonzero, but the

metadata size is larger than the PI tuple. In this case, the remainder

("opaque") of the metadata is left uninitialized.

Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the

metadata is larger than just the PI tuple.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References