{"id":"CVE-2026-98867","revision":"d0c9985899c341f3949f7027b8bc661e","records":[{"revision":"d0c9985899c341f3949f7027b8bc661e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98867","aliases":[],"title":"dm-pcache: bound the logical key offset from persistent memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: bound the logical key offset from persistent memory\n\ncache_key_decode() takes a key's logical off from the cache device and\nlater indexes req_key_tree->subtrees[] by it in get_subtree(). An off\npast the device forms a subtree pointer outside the array, which\nrb_insert() writes through during replay.\n\nReject a key of zero length, or whose off+len (computed in 64 bits)\nexceeds the device size, before it is used.","state":0,"publishedAt":"2026-10-18T15:51:29.499+00:00","modifiedAt":"2026-10-19T09:27:01.563+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-pcache/cache_key.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\n                            \"lessThan\": \"3d5a87cb909c1f375f08065b20123fa5db5958d8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\n                            \"lessThan\": \"10449703200076980704894c3d68d6796182371b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\n                            \"lessThan\": \"97fc4b53dbe4a983fdf093243067fa6a64562307\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-pcache/cache_key.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/3d5a87cb909c1f375f08065b20123fa5db5958d8","https://git.kernel.org/stable/c/10449703200076980704894c3d68d6796182371b","https://git.kernel.org/stable/c/97fc4b53dbe4a983fdf093243067fa6a64562307"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98867","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98867","identifiers":["CVE-2026-98867"]},"retained":false,"historicalAffected":[]}],"coverage":[]}