CVE-2026-98867: dm-pcache: bound the logical key offset from persistent memory
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: bound the logical key offset from persistent memory
cachekeydecode() takes a key's logical off from the cache device and later indexes reqkeytree->subtrees[] by it in getsubtree(). An off past the device forms a subtree pointer outside the array, which rbinsert() writes through during replay.
Reject a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for this issue to be triggered?
The persistent-memory cache must contain a cache key with a zero length or with a logical offset and length that extend beyond the cache device size. The vulnerable path is reached when those keys are decoded and replayed.
What is the impact of a malformed persistent-memory cache key?
An out-of-range logical offset can produce a subtree pointer outside the req_key_tree->subtrees[] array. During replay, rb_insert() can write through that invalid pointer.
What can be done if the fix cannot be applied immediately?
The provided data identifies malformed persisted cache keys as the trigger, but does not specify a supported mitigation other than applying the resolved bounds checks. Avoid replaying or using persistent-memory cache contents that may contain zero-length or out-of-device-range keys.