PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-98867 Linux CVE debrief

A vulnerability in the Linux kernel's dm-pcache module has been addressed. The cache_key_decode() function takes a key's logical offset from the cache device and indexes req_key_tree->subtrees[] by it in get_subtree(). An offset past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay. Rejecting a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used, resolves the issue.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-18
Original CVE updated
2026-10-19
Advisory published
2026-10-18
Advisory updated
2026-10-19

Who should care

Linux kernel maintainers, Linux distribution vendors, users of Linux-based systems, and security teams should assess exposure and apply patches as necessary. Affected operators and platforms require vulnerability management and security teams to prioritize patching based on asset inventory and potential exposure.

Why it matters

A vulnerability in the Linux kernel's dm-pcache module could allow an attacker to write arbitrary values to memory. Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches as necessary.

  • Verify Linux kernel versions for potential exposure
  • Assess device configurations for vulnerability
  • Apply patches from Linux kernel maintainers

Technical summary

The Linux kernel's dm-pcache module had a vulnerability where the cache_key_decode() function did not properly bound the logical key offset from persistent memory. This could lead to an out-of-bounds write in the req_key_tree->subtrees[] array during replay. The issue is resolved by rejecting keys with zero length or offsets that exceed the device size. The vulnerability affects Linux kernel versions and requires verification of exposure based on device configurations. Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches as necessary.

Defensive priority

Verify Linux kernel versions and assess exposure based on device configurations.

Recommended defensive actions

  • Verify Linux kernel versions and assess device configurations for potential exposure
  • Review and apply patches from Linux kernel maintainers
  • Monitor system logs for suspicious activity related to dm-pcache
  • Perform vulnerability assessment and prioritize patching based on asset inventory
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Linux kernel references are also available. The vulnerability affects Linux kernel versions and requires verification of exposure based on device configurations. The issue is resolved by rejecting keys with zero length or offsets that exceed the device size. Defenders should verify Linux kernel versions, assess device configurations, and apply patches from Linux kernel maintainers.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-98867 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-98867

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-98867 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98867

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • dm-pcache: bound the logical key offset from persistent memory

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98867.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3d5a87cb909c1f375f08065b20123fa5db5958d8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/10449703200076980704894c3d68d6796182371b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/97fc4b53dbe4a983fdf093243067fa6a64562307

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.