{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99136 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99136 is a vulnerability in Linux, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99136 and fix it if it is affected.\n\nWhat it is: CVE-2026-99136 is a vulnerability in Linux, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99136 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99136/ (Markdown: https://insights.sbomify.com/CVE-2026-99136/index.md)","id":"CVE-2026-99136","markdown":"https://insights.sbomify.com/CVE-2026-99136/index.md","name":"CVE-2026-99136","record":{"aliases":["AZL-111257","BELL-CVE-2026-99136","DEBIAN-CVE-2026-99136","GHSA-mgww-4g2j-r877","UBUNTU-CVE-2026-99136"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io-\u003eerror before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io-\u003eerror and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destruction\"), because that\ncommit freed dm_crypt_io before calling bio_endio. This is no longer the\ncase, dm_crypt_io lives in the per-bio data now.\n\nRead io-\u003eerror after atomic_dec_and_test instead. atomic_dec_and_test is\nfully ordered, so no additional barrier is needed.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"dm-crypt: fix a tiny race condition in crypt_dec_pending","id":"CVE-2026-99136","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"cifs: don't update i_size in cifs_do_truncate without a cached handle","id":"CVE-2026-99137"},"packages":[],"prev":{"headline":"dm-integrity: fix infinite loop on discard with large tag size","id":"CVE-2026-99135"},"products":["Linux"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99136/"}