Live › vulnerability › CVE-2026-98868
Go to dashboardA forged key count in a dm-pcache cache segment makes the kernel advance past the segment's end during cache replay, writeback and GC. This trips a BUG_ON in cache_pos_advance(), which crashes the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that use the device-mapper dm-pcache target can be hit, because the flaw sits in its cache replay, writeback and GC code. Systems without dm-pcache configured or loaded can skip this. Whether an attacker can supply a forged cache segment on a given host is unknown from the sources.
No product ranges from the sources yet.
lsmod | grep dm_pcacheuname -r and compare it against the fixed release in the kernel stable treeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: reject a kset that overruns its segment
cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it. A forged key_num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache_pos_advance() BUG_ON.
Reject a kset whose on-media size exceeds cache_seg_remain() before use.
This page as .md · .json · in your agent: get_signal("CVE-2026-98868")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.