---
id: CVE-2026-98868
title: 'dm-pcache: reject a kset that overruns its segment'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-pcache: reject a kset that overruns its segment

  cache_replay(), the writeback worker and the GC worker read a kset of
  get_kset_onmedia_size() bytes and advance the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    01a700e9278da5706c865b9ca3ae70fdb7b4531d
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb
  - Linux 6.18
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:51:30.658Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98868'
references:
  - url: 'https://git.kernel.org/stable/c/01a700e9278da5706c865b9ca3ae70fdb7b4531d'
  - url: 'https://git.kernel.org/stable/c/96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10'
  - url: 'https://git.kernel.org/stable/c/7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.457Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: reject a kset that overruns its segment

cache_replay(), the writeback worker and the GC worker read a kset of
get_kset_onmedia_size() bytes and advance the position by it. A forged
key_num makes that size exceed the segment's remaining space, so the
advance walks past the segment and trips the cache_pos_advance() BUG_ON.

Reject a kset whose on-media size exceeds cache_seg_remain() before use.

## Affected

- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 01a700e9278da5706c865b9ca3ae70fdb7b4531d`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.