---
id: CVE-2026-98867
title: 'dm-pcache: bound the logical key offset from persistent memory'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-pcache: bound the logical key offset from persistent memory

  cache_key_decode() takes a key's logical off from the cache device and
  later indexes req_key_tree->subtr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    3d5a87cb909c1f375f08065b20123fa5db5958d8
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    10449703200076980704894c3d68d6796182371b
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    97fc4b53dbe4a983fdf093243067fa6a64562307
  - Linux 6.18
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:51:29.499Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98867'
references:
  - url: 'https://git.kernel.org/stable/c/3d5a87cb909c1f375f08065b20123fa5db5958d8'
  - url: 'https://git.kernel.org/stable/c/10449703200076980704894c3d68d6796182371b'
  - url: 'https://git.kernel.org/stable/c/97fc4b53dbe4a983fdf093243067fa6a64562307'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.457Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: bound the logical key offset from persistent memory

cache_key_decode() takes a key's logical off from the cache device and
later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
past the device forms a subtree pointer outside the array, which
rb_insert() writes through during replay.

Reject a key of zero length, or whose off+len (computed in 64 bits)
exceeds the device size, before it is used.

## Affected

- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 3d5a87cb909c1f375f08065b20123fa5db5958d8`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 10449703200076980704894c3d68d6796182371b`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 97fc4b53dbe4a983fdf093243067fa6a64562307`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.