Quick answers
- Is CVE-2026-98867 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-98867 being exploited in the wild.
- How severe is CVE-2026-98867?
- Informational severity, published 18 October 2026.
- Which products and versions are affected?
- Linux Kernel all versions with dm-pcache (from kernel commit 1d57628ff95b onwards).
- Is there a fix for CVE-2026-98867?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-98867 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-98867?
- Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The cache_key_decode() function in dm-pcache processes logical offsets from cache keys without validating that they fall within the device bounds. An invalid offset causes out-of-bounds indexing into req_key_tree->subtrees[], and rb_insert() writes through the invalid pointer during replay. The fix adds bounds checking to reject keys with zero length or offset+length exceeding device size.
Affected products
- Linux Linux kernel all versions with dm-pcache (from kernel commit 1d57628ff95b onwards)
Timeline
- 2026-10-18: disclosed