CVE-2026-98867: dm-pcache: bound the logical key offset from persistent memory
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: bound the logical key offset from persistent memory
cachekeydecode() takes a key's logical off from the cache device and later indexes reqkeytree->subtrees[] by it in getsubtree(). An off past the device forms a subtree pointer outside the array, which rbinsert() writes through during replay.
Reject a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In dm-pcache cache_key_decode(), reject keys with zero length or whose logical offset plus length, computed in 64 bits, exceeds the device size before using the offset to index req_key_tree->subtrees[].