{"id":"CVE-2026-98868","kind":"vulnerability","aliases":["CVE-2026-98868"],"related":[],"title":"Linux kernel dm-pcache: forged kset size crashes the system via BUG_ON","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: reject a kset that overruns its segment\n\ncache_replay(), the writeback worker and the GC worker read a kset of\nget_kset_onmedia_size() bytes and advance the position by it. A forged\nkey_num makes that size exceed the segment's remaining space, so the\nadvance walks past the segment and trips the cache_pos_advance() BUG_ON.\n\nReject a kset whose on-media size exceeds cache_seg_remain() before use.","summary":"A forged key count in a dm-pcache cache segment makes the kernel advance past the segment's end during cache replay, writeback and GC. This trips a BUG_ON in cache_pos_advance(), which crashes the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-mapper","dm-pcache","kernel","linux","runtime"],"not_affected_if":["dm-pcache-not-used","module-not-loaded"],"how_to_check":"- Check whether the kernel has the dm-pcache module loaded with `lsmod | grep dm_pcache`\n- Check the running kernel version with `uname -r` and compare it against the fixed release in the kernel stable tree\n- unknown for a specific fixed version, as the sources do not say","fix":"- Update the Linux kernel to a release that includes the commit rejecting a kset that overruns its segment\n- unknown for the exact version, as the sources do not say","status":"open","published_at":"2026-10-18T16:17:41+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:47+00:00","updated_at":"2026-10-25T05:12:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:12:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the commit rejecting a kset that overruns its segment\n- unknown for the exact version, as the sources do not say","reach":"local","title":"Linux kernel dm-pcache: forged kset size crashes the system via BUG_ON","impact":"low","summary":"A forged key count in a dm-pcache cache segment makes the kernel advance past the segment's end during cache replay, writeback and GC. This trips a BUG_ON in cache_pos_advance(), which crashes the kernel.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","device-mapper","dm-pcache"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel BUG_ON crashes the host, causing denial of service.","analyst_note":"Confirm the fixed kernel release and whether an unprivileged user can write a forged cache segment, using the NVD entry and the linked kernel commit.","how_to_check":"- Check whether the kernel has the dm-pcache module loaded with `lsmod | grep dm_pcache`\n- Check the running kernel version with `uname -r` and compare it against the fixed release in the kernel stable tree\n- unknown for a specific fixed version, as the sources do not say","needs_analyst":true,"not_affected_if":["dm-pcache-not-used","module-not-loaded"],"who_is_affected":"Only systems that use the device-mapper dm-pcache target can be hit, because the flaw sits in its cache replay, writeback and GC code. Systems without dm-pcache configured or loaded can skip this. Whether an attacker can supply a forged cache segment on a given host is unknown from the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3386,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98868':16A,19A 'advanc':43B,63B,107C,127C,137C 'bug':13A,58B,138C 'byte':105C 'cach':38B,50B,61B,88C,135C,149C 'count':32B 'crash':9A,65B 'cve':14A,17A 'devic':21B 'device-mapp':20B 'dm':4A,24B,36B,79C 'dm-pcach':3A,23B,35B,78C 'end':48B 'exceed':119C,148C 'follow':73C 'forg':6A,30B,113C 'gc':54B,95C 'get':101C 'kernel':2A,26B,42B,67B,71C 'key':31B,114C 'kset':7A,83C,99C,102C,142C 'linux':1A,27B,70C 'make':40B,116C 'mapper':22B 'media':146C 'num':115C 'on-media':144C 'onmedia':103C 'overrun':85C 'past':44B,129C 'pcach':5A,25B,37B,80C 'pos':62B,136C 'posit':109C 'read':97C 'reject':81C,140C 'remain':123C,151C 'replay':51B,89C 'resolv':77C 'runtim':28B 'seg':150C 'segment':39B,46B,87C,121C,131C 'size':8A,104C,118C,147C 'space':124C 'system':11A 'trip':56B,133C 'use':153C 'via':12A 'vulner':74C 'walk':128C 'whose':143C 'worker':92C,96C 'writeback':52B,91C","nicknames":[],"mitigations":[],"who_affected":"Only systems that use the device-mapper dm-pcache target can be hit, because the flaw sits in its cache replay, writeback and GC code. Systems without dm-pcache configured or loaded can skip this. Whether an attacker can supply a forged cache segment on a given host is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98868","severity":null,"published_at":"2026-10-18T16:17:41+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}