CVE-2026-23007

An information disclosure vulnerability was found in the Linux kernel's block layer integrity handling. When auto-generating integrity buffers for writes with protection information (PI) enabled, the non-PI portion of the metadata buffer is left uninitialized if the metadata size exceeds the PI tuple size. This uninitialized kernel memory can be read back by userspace or anyone with physical access to the storage device.

This vulnerability allows kernel memory contents to leak to storage media and potentially be read back by userspace. It affects block devices with integrity/PI metadata where the metadata size is larger than the PI tuple. The information disclosure requires specific storage hardware configurations with extended metadata support and the ability to read back the written data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.