CVE-2026-98867

What it actually does

Out-of-bounds write via unchecked logical offset from persistent cache device used to index into fixed-size subtrees array, allowing rb_insert to write through invalid pointer during replay.

Why it matters to the business

Linux systems using dm-pcache for storage caching face risk of kernel memory corruption, crashes, or potential local privilege escalation; urgency is moderate given twelve days since disclosure and absence from known exploited lists.

How an attack unfolds

An attacker with ability to write arbitrary keys into the persistent cache device crafts a zero-length key or one whose offset-plus-length exceeds device size; on cache replay, cache_key_decode accepts the key, get_subtree performs out-of-bounds array indexing, and rb_insert writes through the resulting invalid subtree pointer.

How to fix it

Update the Linux kernel to a version containing the bounds check that rejects zero-length keys and keys whose computed off+len exceeds device size before use in cache_key_decode.

How to confirm the fix worked

Confirm kernel source contains the added length and offset validation in cache_key_decode; exercise dm-pcache replay with both valid and out-of-bounds keys to verify rejection; monitor for absence of related oops messages.

Typical attack path

1. Obtain write access to the dm-pcache device or underlying persistent memory
2. Store a malicious key record with invalid logical offset or zero length
3. Trigger cache replay or device initialization that invokes cache_key_decode
4. Cause get_subtree to compute out-of-bounds index into req_key_tree->subtrees
5. Execute rb_insert write through the resulting invalid pointer

How to detect it

Search kernel logs for oops or panic traces containing cache_key_decode, get_subtree, or rb_insert symbols originating from dm-pcache; inspect persistent cache device contents for keys with zero length or offsets near device capacity during forensic review.

What your security team should do

• Apply the upstream dm-pcache bounds-check patch at the earliest maintenance window
• Restrict untrusted local access to systems exposing dm-pcache devices until patched
• Review dm-pcache usage in storage stacks and consider disabling the module where not required
• Add kernel oops and panic monitoring for dm-pcache symbols to detect attempted exploitation