CVE-2026-89169: live-boot Auth Bypass Vulnerability

CVE-2026-89169 Overview

CVE-2026-89169 affects Debian live-boot at commit ff8867c, where attackers can bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. The flaw sits in the boot-time overlay logic that validates the signed root hash used by device-mapper verity (dm-verity). When the expected signature file is absent, the enforcement check does not fail closed, allowing an unsigned or tampered root filesystem to be trusted during boot. The weakness is classified under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
An attacker with physical access to a Debian live boot medium can undermine root filesystem integrity guarantees by removing the .verity file, defeating the signed-roothash enforcement that dm-verity is intended to provide.

Affected Products

Debian live-boot at commit ff8867c (ff8867c4e2d62e497cb895b15b7d6d518d5adff1)
Debian Live images that rely on 9990-overlay.sh for dm-verity roothash signature enforcement
Downstream distributions packaging the affected live-boot component

Discovery Timeline

2026-09-11 - CVE-2026-89169 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89169

Vulnerability Analysis

The vulnerability resides in the Debian live-boot overlay script components/9990-overlay.sh at lines 112–114. The script is responsible for wiring up dm-verity for the read-only root filesystem when the boot parameter dm-verity-enforce-roothash-signature is set. Under normal conditions, live-boot should require both the verity metadata and a signature file (.verity) before mounting the root, and it should refuse to proceed if either is missing.

In the affected revision, the enforcement branch does not treat a missing .verity file as a fatal condition. Instead, the boot flow continues without validating a signed root hash, effectively downgrading the integrity policy the operator explicitly requested. An attacker who can modify the boot medium can remove the .verity file and substitute a modified root filesystem while retaining apparent compliance with the boot argument.

The practical result is a loss of filesystem integrity guarantees. Any binary, configuration, or service present on the modified root will execute with full trust after boot. Details are tracked in Debian Bug Report #1146422 and the affected code is visible in the Debian Live Boot Overlay Script.

Root Cause

The root cause is missing signature verification when a required artifact is absent. The dm-verity-enforce-roothash-signature code path checks for signature presence but does not abort when the .verity file is not found. Fail-open behavior in a security enforcement path is the direct source of the bypass.

Attack Vector

Exploitation requires physical access to the live boot medium (USB stick, optical disc image, or writable image file). The attacker deletes the .verity file and, optionally, replaces the root filesystem contents. On the next boot, live-boot proceeds without enforcing the signed root hash, and the tampered root is mounted and executed.

Attack outline (prose):
1. Attacker obtains write access to the live-boot media.
2. Attacker removes the .verity signature file from the media.
3. Attacker modifies or replaces the squashfs/root filesystem image.
4. System boots with dm-verity-enforce-roothash-signature set,
   but live-boot does not fail closed on the missing .verity file.
5. Tampered root filesystem is mounted and used.

Detection Methods for CVE-2026-89169

Indicators of Compromise

Absence of the expected .verity signature file on live-boot media that is configured to enforce signed root hashes.
Unexpected modification timestamps or checksum mismatches on the squashfs root filesystem shipped on live media.
Boot logs showing dm-verity setup completing without a signature verification step when dm-verity-enforce-roothash-signature is passed.

Detection Strategies

Perform pre-boot integrity checks of live media by hashing the root filesystem and confirming the presence and validity of the .verity file before distribution and after retrieval.
Compare the runtime state of /proc/cmdline and dmsetup table output against expected dm-verity configurations to confirm a signed hash was used.
Audit live-boot package versions across build pipelines and reject builds pinned to the vulnerable ff8867c commit.

Monitoring Recommendations

Monitor build systems and image repositories for changes to .verity artifacts and squashfs images outside of authorized pipelines.
Log and review physical access to systems that boot from removable live media, including kiosks, forensic workstations, and recovery devices.
Track upstream live-boot advisories and Debian bug tracker updates for regression fixes and follow-on issues.

How to Mitigate CVE-2026-89169

Immediate Actions Required

Inventory all systems and images built from live-boot at commit ff8867c and flag them for rebuild once a fixed version is available.
Physically secure live-boot media and restrict who can write to distribution images or removable media used for booting.
Verify the presence and validity of the .verity file on every image that relies on dm-verity-enforce-roothash-signature before deployment.

Patch Information

No fixed version is listed in the NVD record at publication. Track the upstream fix through the Debian Bug Report #1146422 and rebuild live images against a corrected live-boot once released. Until a patched release is available, treat any live image built from the affected commit as unable to enforce signed root hashes.

Workarounds

Distribute live media only through channels that provide out-of-band integrity verification, such as detached signatures over the entire image.
Enforce Secure Boot and signed bootloader/kernel chains so that unauthorized modification of boot components requires additional trust breaks.
Where feasible, boot from read-only media (write-protected USB, pressed optical media) to prevent removal of the .verity file after distribution.
Add build-pipeline checks that abort image production if the .verity file is not generated alongside the signed root hash.

bash

# Configuration example: verify .verity presence before shipping an image
IMAGE_DIR="/srv/live-images/current"
if [ ! -f "${IMAGE_DIR}/filesystem.squashfs.verity" ]; then
    echo "ERROR: .verity file missing - refusing to publish image" >&2
    exit 1
fi
sha256sum "${IMAGE_DIR}/filesystem.squashfs" \
          "${IMAGE_DIR}/filesystem.squashfs.verity" \
    > "${IMAGE_DIR}/SHA256SUMS"