Cloudanix VulnDB

CVE-2026-98161

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A storage driver bug on certain memory hardware could let important data-saving steps be skipped, raising the chance of corrupted or lost information.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Medium

What it actually does

The flaw in pmem_submit_bio allows a recorded REQ_PREFLUSH error to be overwritten by a later successful REQ_FUA, permitting data writes to complete after a failed ordering barrier and violating required flush-before-write semantics on persistent memory.

Why it matters to the business

Systems relying on persistent memory for ordered, durable writes face elevated risk of data corruption or loss, which can disrupt storage reliability and require extended recovery windows in affected Linux deployments.

How an attack unfolds

An attacker with local access submits specially ordered block I/O requests that force a preflush failure; the driver continues copying data and masks the error via a subsequent FUA flush, allowing the bio to succeed without the intended barrier.

How to fix it

Apply the upstream kernel fix that performs the REQ_PREFLUSH synchronously before any bio data handling and returns the flush error immediately on failure while retaining asynchronous chaining only for post-data REQ_FUA.

How to confirm the fix worked

Confirm the corrected pmem_submit_bio logic is present in the running kernel source or binary; test by injecting flush failures and verifying that the bio completes with the flush error rather than proceeding to data copy.

Typical attack path

  1. Obtain local user or process access on a Linux system with pmem/nvdimm storage
  2. Craft or trigger block I/O submissions containing REQ_PREFLUSH operations that fail
  3. Observe or induce continued data writes that bypass the failed flush ordering
  4. Achieve completion of the bio despite the missing durability barrier

How to detect it

Review kernel logs and block I/O traces for pmem_submit_bio entries that record flush errors yet report successful bio completion; correlate with nvdimm device activity around the time of suspected ordering violations.

What your security team should do

  • Prioritize kernel updates on systems exposing pmem or nvdimm devices
  • Audit workloads that depend on strict write ordering for durability guarantees
  • Monitor for future stable kernel releases containing the described synchronous flush change

The record

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQ_FUA flush. That lets data writes run after a failed preflush and can complete the bio successfully despite the failed ordering barrier. Run the REQ_PREFLUSH flush synchronously before touching the bio data and complete the bio with the flush error if it fails. Keep asynchronous flush chaining for REQ_FUA. At that point, data copy has completed and the parent bio can wait for the chained flush bio.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities