{"id":"CVE-2026-93198","revision":"07e08f3e87c349b5ad9f8ca583ac902a","records":[{"revision":"07e08f3e87c349b5ad9f8ca583ac902a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93198","aliases":[],"title":"dm-pcache: validate the persisted dirty_tail chain at load","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: validate the persisted dirty_tail chain at load\n\nThe writeback worker follows the persisted dirty_tail chain, which is\ndecoded from the cache device independently of the key_tail chain that\ncache_replay() walks and bounds. A crafted image, whose on-media fields are\nauthenticated only by a crc32c with a fixed seed, can aim dirty_tail at a\nchain of last ksets that never terminates, so cache_writeback_fn() re-arms\nitself with no delay forever.\n\nWalk the dirty_tail chain once at load with the same hop cap cache_replay()\nuses and fail the table load with -EIO if it does not reach an end within\nn_segs hops.","state":0,"publishedAt":"2026-09-17T16:12:20.439+00:00","modifiedAt":"2026-10-19T09:07:10.545+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-pcache/cache.c\",\n                        \"drivers/md/dm-pcache/cache.h\",\n                        \"drivers/md/dm-pcache/cache_key.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\n                            \"lessThan\": \"8195cf3f4a82ef49d9b0651c507ed0784caf23fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\n                            \"lessThan\": \"4822a030929e0e77aa380722dc42e3e4c9edd346\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\n                            \"lessThan\": \"58d620ee9e01d4bdbceaf2ae1450d307a2a9d58b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-pcache/cache.c\",\n                        \"drivers/md/dm-pcache/cache.h\",\n                        \"drivers/md/dm-pcache/cache_key.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8195cf3f4a82ef49d9b0651c507ed0784caf23fb","https://git.kernel.org/stable/c/4822a030929e0e77aa380722dc42e3e4c9edd346","https://git.kernel.org/stable/c/58d620ee9e01d4bdbceaf2ae1450d307a2a9d58b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93198","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93198","identifiers":["CVE-2026-93198"]},"retained":false,"historicalAffected":[]}],"coverage":[]}