Cloudanix VulnDB

CVE-2026-98868

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux storage caching code could let specially crafted data crash the whole computer during normal operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper validation of on-media kset size allows get_kset_onmedia_size() to return a value exceeding cache_seg_remain(), causing cache_pos_advance() to walk past the segment boundary and trigger a kernel BUG_ON in cache_replay, writeback, and GC workers.

Why it matters to the business

Systems using dm-pcache for persistent block caching may experience unexpected kernel panics, leading to service outages, data unavailability, and forced reboots during normal cache operations or replay.

How an attack unfolds

An attacker with the ability to supply or modify on-media cache metadata forges a key_num field so the computed kset size overruns the current segment; when the kernel workers later read and advance past this kset they hit the internal assertion and crash the system.

How to fix it

Apply the upstream kernel patch that adds an explicit check rejecting any kset whose on-media size exceeds cache_seg_remain before the size is used; rebuild and deploy the fixed kernel to all affected hosts.

How to confirm the fix worked

Boot the patched kernel, exercise cache_replay and worker paths with both valid and boundary-case segments, and confirm no BUG_ON is triggered; review dmesg for the new rejection message on oversized ksets.

Typical attack path

  1. Obtain or craft a dm-pcache segment containing a malicious kset header with an oversized key_num
  2. Place the segment on the backing device so it is read by cache_replay or a worker thread
  3. Trigger cache activity that invokes get_kset_onmedia_size followed by cache_pos_advance
  4. Observe kernel panic from the BUG_ON when the position advances beyond the segment

How to detect it

Search kernel logs for cache_pos_advance BUG_ON messages and unexpected dm-pcache worker crashes; correlate with recent cache segment writes or device-mapper activity around the time of the panic.

What your security team should do

  • Prioritize patching production systems that mount dm-pcache volumes within the next maintenance window
  • Monitor upstream stable kernel releases for the dm-pcache fix and schedule controlled rollouts
  • Add kernel crash and BUG_ON alerts to existing monitoring to detect any post-patch regressions

The record

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it. A forged key_num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache_pos_advance() BUG_ON. Reject a kset whose on-media size exceeds cache_seg_remain() before use.

Affected packages

Ecosystem Package Introduced Fixed