{"id":"CVE-2026-98867","kind":"vulnerability","aliases":["CVE-2026-98867"],"related":[],"title":"Linux kernel dm-pcache: unchecked key offset can write outside a kernel array","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: bound the logical key offset from persistent memory\n\ncache_key_decode() takes a key's logical off from the cache device and\nlater indexes req_key_tree->subtrees[] by it in get_subtree(). An off\npast the device forms a subtree pointer outside the array, which\nrb_insert() writes through during replay.\n\nReject a key of zero length, or whose off+len (computed in 64 bits)\nexceeds the device size, before it is used.","summary":"The Linux kernel's dm-pcache device-mapper cache reads a key's logical offset from persistent memory and uses it to index an array without a bounds check. A crafted or corrupted cache device can make the kernel write through an out-of-range pointer during replay.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dm-pcache","infrastructure","linux-kernel","persistent-memory","self-hosted"],"not_affected_if":["dm-pcache-not-used"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:41+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:47+00:00","updated_at":"2026-10-25T05:12:47+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:12:47Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel dm-pcache: unchecked key offset can write outside a kernel array","impact":"high","summary":"The Linux kernel's dm-pcache device-mapper cache reads a key's logical offset from persistent memory and uses it to index an array without a bounds check. A crafted or corrupted cache device can make the kernel write through an out-of-range pointer during replay.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","dm-pcache","persistent-memory","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption during cache replay, possibly code execution","analyst_note":"Find the fixed kernel versions and stable commit in the upstream kernel CVE record and check whether dm-pcache is enabled in common distro kernels.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["dm-pcache-not-used"],"who_is_affected":"Systems running a Linux kernel with the dm-pcache device-mapper target built or loaded and a persistent memory cache device. The sources do not say which kernel versions are affected or whether the default configuration enables dm-pcache.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00057,"input_tokens":3382,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98867':17A,20A '64':162C 'array':14A,60B,142C 'bit':163C 'bound':63B,98C 'cach':44B,69B,106C,117C 'check':64B 'comput':160C 'corrupt':68B 'craft':66B 'cve':15A,18A 'decod':108C 'devic':42B,70B,118C,135C,166C 'device-mapp':41B 'dm':4A,22B,39B,96C 'dm-pcach':3A,21B,38B,95C 'exceed':164C 'follow':90C 'form':136C 'get':129C 'host':33B 'index':58B,121C 'infrastructur':24B 'insert':145C 'kernel':2A,13A,27B,36B,74B,88C 'key':7A,47B,101C,107C,111C,123C,152C 'later':120C 'len':159C 'length':155C 'linux':1A,26B,35B,87C 'linux-kernel':25B 'logic':49B,100C,113C 'make':72B 'mapper':43B 'memori':30B,53B,105C 'offset':8A,50B,102C 'out-of-rang':78B 'outsid':11A,140C 'past':133C 'pcach':5A,23B,40B,97C 'persist':29B,52B,104C 'persistent-memori':28B 'pointer':82B,139C 'rang':81B 'rb':144C 'read':45B 'reject':150C 'replay':84B,149C 'req':122C 'resolv':94C 'self':32B 'self-host':31B 'size':167C 'subtre':125C,130C,138C 'take':109C 'tree':124C 'uncheck':6A 'use':55B,171C 'vulner':91C 'whose':157C 'without':61B 'write':10A,75B,146C 'zero':154C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the dm-pcache device-mapper target built or loaded and a persistent memory cache device. The sources do not say which kernel versions are affected or whether the default configuration enables dm-pcache.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98867","severity":null,"published_at":"2026-10-18T16:17:41+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}