CVE-2026-98868: dm-pcache: reject a kset that overruns its segment
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: reject a kset that overruns its segment
cachereplay(), the writeback worker and the GC worker read a kset of getksetonmediasize() bytes and advance the position by it. A forged keynum makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cacheposadvance() BUGON.
Reject a kset whose on-media size exceeds cachesegremain() before use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In dm-pcache, reject a kset whose on-media size exceeds the remaining segment cache space (cache_seg_remain()) before using it in cache_replay(), the writeback worker, or the GC worker.
Event History
Frequently Asked Questions
What access would an attacker need to trigger this issue?
An attacker would need to forge on-media dm-pcache metadata so that its key_num value causes a kset size to exceed the remaining space in a segment. The supplied information does not establish whether this can be done without access to the underlying cache data or device.
What is the likely impact when the malformed metadata is processed?
During cache replay, writeback, or garbage-collection processing, the invalid size can advance beyond the segment boundary and trigger the cache_pos_advance() BUG_ON. This indicates a kernel failure condition when the forged kset is used.
How can I determine whether a system needs the fix?
Systems using dm-pcache are relevant because the affected paths are cache replay, the writeback worker, and the GC worker. Review the kernel source or applied stable patches for the validation that rejects a kset when its on-media size exceeds cache_seg_remain() before it is used.