CVE-2026-98868 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: reject a kset that overruns its segment
cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it. A forged key_num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache_pos_advance() BUG_ON.
Reject a kset whose on-media size exceeds cache_seg_remain() before use.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel device-mapper persistent-cache subsystem contains a critical logic flaw within its data structure handling mechanisms that can lead to a denial of service condition through a kernel panic. The vulnerability resides in the dm-pcache module, which manages caching for block devices by organizing cached data into segments and sets known as ksets. These structures are fundamental to the operation of the cache replay, writeback worker, and garbage collection workers, all of which rely on accurately determining the boundaries of these data units to function correctly without corrupting memory or violating kernel invariants.
The core technical flaw involves an insufficient validation check when processing a key number associated with a kset during read operations. Specifically, functions such as cache_replay(), along with background tasks like the writeback worker and garbage collection worker, invoke get_kset_onmedia_size() to determine the size of a kset stored on disk. This retrieved size is then used to advance an internal position pointer via cache_pos_advance(). The vulnerability arises because there was no prior verification that this reported size actually fits within the remaining space of the current segment. If a forged or corrupted key_num results in get_kset_onmedia_size() returning a value larger than what remains available in the segment, the subsequent advancement operation causes the position pointer to walk past the end of the valid segment boundary.
This out-of-bounds access triggers a BUG_ON assertion within cache_pos_advance(). In Linux kernel development, BUG_ON is used to catch conditions that should never happen under normal circumstances and typically results in an immediate kernel panic or crash when triggered. Consequently, this vulnerability allows any entity with write access to the underlying block device hosting the persistent-cache metadata to induce a system-wide denial of service by crafting malicious kset entries that exceed segment limits. The attacker does not need elevated privileges beyond those required to modify the cached data structures, making local privilege escalation or simple disruption possible depending on the context in which dm-pcache is deployed.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write, as the system fails to validate that input-derived sizes conform to expected structural constraints before performing pointer arithmetic. In terms of attack vectors, this relates to ATT&CK technique T1499 Endpoint Denial of Service, where an adversary disrupts availability by exploiting software flaws to crash systems or services. The lack of boundary checking represents a fundamental failure in defensive programming practices common in low-level system code handling untrusted metadata from storage media.
To mitigate this vulnerability, the kernel developers have implemented a strict validation check that rejects any kset whose on-media size exceeds the remaining capacity of its segment as determined by cache_seg_remain(). This patch ensures that invalid or corrupted entries are discarded before they can influence pointer arithmetic operations. Administrators and users relying on dm-pcache should ensure their systems are updated with kernel versions containing this fix to prevent potential crashes caused by malformed cached data structures. Additionally, implementing integrity monitoring for block device metadata can help detect attempts to inject such malicious kset entries into the cache subsystem.