CVE-2026-98867 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: bound the logical key offset from persistent memory
cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay.
Reject a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's device-mapper persistent cache subsystem contains a critical out-of-bounds write vulnerability within its key decoding and subtree management logic. This flaw resides specifically in the interaction between the cache_key_decode function and the get_subtree routine during the replay of cached data structures from persistent memory. The dm-pcache driver is designed to accelerate storage operations by caching frequently accessed blocks, relying on a complex tree structure to map logical offsets to physical locations within the device. When the system replays its state after a reboot or crash, it reads previously stored keys and attempts to reconstruct the internal radix tree that manages these mappings. The vulnerability arises because the code fails to validate whether the logical offset extracted from a key is within the valid bounds of the underlying cache device before using it as an index into the subtree array.
During normal operation, when a cached entry needs to be accessed or replayed, the kernel calls cache_key_decode to extract metadata such as the logical offset and length associated with that specific block. This decoded information is then passed to get_subtree, which uses the logical offset to calculate an index for accessing elements in the req_key_tree->subtrees array. Under normal circumstances, this offset would correspond to a valid position within the allocated memory space of the subtree pointers. However, if the persistent storage contains corrupted data or maliciously crafted keys where the logical offset exceeds the actual size of the cache device, the calculated index will point outside the bounds of the subtrees array. This condition creates an out-of-bounds write scenario because subsequent operations, particularly rb_insert which is used to insert nodes into the red-black tree structure during replay, attempt to write through this invalid pointer.
The operational impact of this vulnerability is severe due to its potential for memory corruption and system instability. An attacker who can influence or corrupt the persistent memory contents associated with dm-pcache could trigger an out-of-bounds write by providing a key with a logical offset that maps beyond the end of the subtrees array. This type of memory safety violation typically leads to heap corruption, which can result in kernel panics and denial of service conditions where the system becomes unresponsive or crashes unexpectedly. In more sophisticated attack scenarios involving controlled memory layouts, such out-of-bounds writes might be leveraged for arbitrary code execution by overwriting critical function pointers or other control data structures within the kernel space. The risk is heightened because this flaw occurs during state replay, a process that may happen automatically upon system startup if persistent cache files are present and unverified.
This vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing to a memory location outside of the intended buffer boundaries due to insufficient validation of input values derived from external storage. From an ATT&CK perspective, this flaw could be exploited in the context of T1562: Impair Defenses or potentially T1059: Command and Scripting Interpreter if the resulting instability is used as a precursor for further exploitation techniques that rely on kernel memory corruption. The root cause lies in the lack of rigorous boundary checks before utilizing data retrieved from persistent storage, highlighting the importance of validating all inputs derived from non-volatile media even when they are assumed to be trusted remnants of previous sessions.
To mitigate this vulnerability, it is essential to enforce strict validation rules for any key metadata extracted during the replay process. Specifically, implementations must reject keys that have a zero length or where the sum of the logical offset and the associated length exceeds the total size of the cache device. These checks should be performed in 64-bit arithmetic to prevent integer overflow issues that could otherwise mask out-of-bounds conditions when dealing with large storage devices. By ensuring that all offsets are strictly bounded by the physical limits of the underlying hardware, developers can prevent the calculation of invalid array indices and eliminate the possibility of writing outside the subtrees array. Regular auditing of device-mapper subsystems for similar boundary validation gaps is also recommended to maintain overall system integrity against memory corruption attacks.