CVE-2026-98161

Analyzed Analyzed - Analysis Complete

Linux Kernel pmem PREFLUSH Ordering Flaw

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQ_FUA flush. That lets data writes run after a failed preflush and can complete the bio successfully despite the failed ordering barrier. Run the REQ_PREFLUSH flush synchronously before touching the bio data and complete the bio with the flush error if it fails. Keep asynchronous flush chaining for REQ_FUA. At that point, data copy has completed and the parent bio can wait for the chained flush bio.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98161

EUVD

EUVD-2026-87061

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.6 (exc)
linux	linux_kernel	From 5.3 (inc) to 6.18.52 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the pmem driver where a REQ_PREFLUSH error is recorded but later overwritten by a successful REQ_FUA flush. This allows data writes to proceed after a failed preflush, potentially completing successfully despite the failed ordering barrier, which could lead to data corruption or loss.

Detection Guidance

This vulnerability is specific to the Linux kernel's pmem driver and requires kernel-level inspection. Detection involves checking kernel logs for REQ_PREFLUSH errors or analyzing the pmem driver behavior during flush operations. No standard network or system commands directly detect this issue without kernel-level access.

Impact Analysis

This vulnerability could lead to data corruption or loss on systems using NVDIMM (Non-Volatile Dual In-line Memory Module) storage. If the preflush operation fails but the system proceeds with data writes, critical data may not be properly saved, potentially causing application crashes or filesystem corruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel memory management issue. Compliance impacts would depend on how the affected system is used in a specific environment.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for REQ_PREFLUSH errors in pmem operations. Ensure proper error handling in applications using pmem devices to prevent data corruption from failed flushes.

Hi! I’m here to help you understand CVE-2026-98161. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70