CVE-2026-98867
Received Received - Intake

dm-pcache Logical Key Offset Validation Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in get_subtree(). An off past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay. Reject a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98867
EUVD
EUVD-2026-103807

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0
Linux Linux 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0
Linux Linux 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0
Linux Linux 6.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the dm-pcache component where a key's logical offset from persistent memory is improperly handled. The function cache_key_decode() extracts this offset and uses it to index into req_key_tree->subtrees[]. If the offset is beyond the device's bounds, it can lead to writing outside the intended memory area during replay operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's dm-pcache module and involves improper handling of cache keys. Detection requires checking kernel logs for errors related to dm-pcache or cache key decoding failures. No direct commands are provided in the context, but monitoring for kernel errors or crashes in dm-pcache operations may indicate exploitation.

Impact Analysis

This vulnerability could allow an attacker to corrupt memory or execute arbitrary code by exploiting the out-of-bounds write during key replay. It may lead to system crashes, data corruption, or unauthorized access, depending on the attacker's capabilities and system configuration.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux dm-pcache module. Compliance risks would only arise if exploitation led to data integrity or confidentiality breaches, which is not described in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the dm-pcache vulnerability. Monitor kernel security advisories for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart