In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory… (CVE-2026-98867)

The Linux kernel's dm-pcache module had a vulnerability where the cache_key_decode() function accepted a logical key offset from the cache device without properly bounding it. This offset was later used to index the req_key_tree->subtrees[] array in get_subtree(). If the offset plus length exceeded the device size, it caused an out-of-bounds pointer, which rb_insert() would write through during replay, potentially leading to memory corruption. The vulnerability was mitigated by rejecting keys of zero length or keys where offset plus length (calculated in 64 bits) exceeded the device size prior to usage.

This vulnerability could lead to out-of-bounds memory writes in the Linux kernel's dm-pcache subsystem, potentially causing memory corruption or instability. No specific exploitation details or active exploits are reported. The impact is limited to systems using the affected dm-pcache functionality.

A fix has been applied to the Linux kernel to reject invalid keys that could cause out-of-bounds access in dm-pcache. Users should update to a kernel version that includes this fix. No additional mitigation steps are indicated.