# CVE-2026-98867: Linux kernel dm-pcache out-of-bounds write in cache key handling

Source: https://junglewise.ai/threats/cve-2026-98867-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-98867 · Severity: info · Published 2026-10-18

The Linux kernel's device-mapper persistent cache component fails to validate cache key offsets before use, allowing an out-of-bounds write to kernel memory. An attacker with the ability to craft a malicious cache device could exploit this to corrupt kernel data structures or gain code execution.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-98867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98867 being exploited in the wild.

**How severe is CVE-2026-98867?** Informational severity, published 18 October 2026.

**Which products and versions are affected?** Linux Kernel all versions with dm-pcache (from kernel commit 1d57628ff95b onwards).

**Is there a fix for CVE-2026-98867?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-98867 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-98867?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The cache_key_decode() function in dm-pcache processes logical offsets from cache keys without validating that they fall within the device bounds. An invalid offset causes out-of-bounds indexing into req_key_tree->subtrees[], and rb_insert() writes through the invalid pointer during replay. The fix adds bounds checking to reject keys with zero length or offset+length exceeding device size.

## Affected products

- Linux Linux kernel all versions with dm-pcache (from kernel commit 1d57628ff95b onwards)

## Timeline

- 2026-10-18: disclosed

## References

- [https://git.kernel.org/stable/c/10449703200076980704894c3d68d6796182371b](https://git.kernel.org/stable/c/10449703200076980704894c3d68d6796182371b)
- [https://git.kernel.org/stable/c/3d5a87cb909c1f375f08065b20123fa5db5958d8](https://git.kernel.org/stable/c/3d5a87cb909c1f375f08065b20123fa5db5958d8)

## Related threats

- [Linux kernel dm-pcache buffer over-read in segment processing](https://junglewise.ai/threats/cve-2026-98868-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel use-after-free in scheduler cache group access](https://junglewise.ai/threats/cve-2026-98866-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel sched_ext deadlock in ops.dequeue() with DSQ lock](https://junglewise.ai/threats/cve-2026-98865-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel sched_ext task reenqueue state synchronization](https://junglewise.ai/threats/cve-2026-98864-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel KVM nested state pages memory safety issue](https://junglewise.ai/threats/cve-2026-98863-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)