Live-boot dm-verity Bypass via Missing .verity
CVE-2026-89169 Published on September 11, 2026

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

NVD

Vulnerability Analysis

CVE-2026-89169 can be exploited with physical access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
PHYSICAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.


Affected Versions

Debian live-boot Version ff8867c4e2d62e497cb895b15b7d6d518d5adff1 is affected by CVE-2026-89169