UBUNTU-CVE-2026-98868: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cachereplay(), the writeback worker and the GC worker read a kset of getksetonmediasize() bytes and advance the position by it. A forged keynum makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cacheposadvance() BUGON. Reject a kset whose on-media size exceeds cachesegremain() before use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Before using a kset in cache_replay(), the writeback worker, or the GC worker, reject it if its on-media size exceeds the remaining segment cache space.
Linux kernel dm-pcache kset on-media size validation = reject when get_kset_onmedia_size() exceeds cache_seg_remain()
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
An attacker needs to forge an on-media kset with a key_num that causes its computed size to exceed the remaining space in a segment. The vulnerable cache replay, writeback, or garbage-collection worker must then process that kset.
What is the likely impact if the malformed kset is processed?
Advancing past the end of the segment triggers the cache_pos_advance() BUG_ON. The provided data indicates a kernel fault condition rather than data describing code execution or privilege escalation.
How can I determine whether systems are exposed?
Review systems using the listed Ubuntu Linux kernel packages and determine whether they use dm-pcache with on-media segment data that could be untrusted or corrupted. The affected condition is specifically a kset whose on-media size is larger than cache_seg_remain().
What mitigation is available when an update cannot be applied immediately?
Avoid processing untrusted or potentially corrupted dm-pcache on-media data, since exploitation depends on a forged kset being consumed by cache replay, writeback, or garbage collection. The supplied data does not identify an alternative configuration-based fix.