CVE-2026-98867
Linux: dm-pcache: bound the logical key offset from persistent memory
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3d5a87cb909c1f375f08065b20123fa5db5958d8Also 10449703200076980704894c3d68d6796182371b, 97fc4b53dbe4a983fdf093243067fa6a64562307CVE List
What fixes it
- 3d5a87cb909c1f375f08065b20123fa5db5958d8LinuxCVE List
- 10449703200076980704894c3d68d6796182371bLinuxCVE List
- 97fc4b53dbe4a983fdf093243067fa6a64562307LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: bound the logical key offset from persistent memory
cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in get_subtree(). An off past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay.
Reject a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used.
Text from CVE List
Affected versions 8
- Linuxaffected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 before 3d5a87cb909c1f375f08065b20123fa5db5958d8CVE List
- Linuxaffected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 before 10449703200076980704894c3d68d6796182371bCVE List
- Linuxaffected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 before 97fc4b53dbe4a983fdf093243067fa6a64562307CVE List
- Linuxaffected: 6.18CVE List
- Linuxunaffected: all versions before 6.18CVE List
- Linuxunaffected: 6.18.52 through 6.18.*CVE List
- Linuxunaffected: 7.2.10 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List