In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cache_replay(), the writeback… (CVE-2026-98868)

The Linux kernel dm-pcache module had a vulnerability where the cache_replay(), writeback worker, and GC worker functions read a kset of get_kset_onmedia_size() bytes and advanced the read position by that amount. A maliciously forged key_num could cause the reported size to exceed the segment's remaining space, resulting in the advance operation walking past the segment boundary and triggering a BUG_ON via cache_pos_advance(). The vulnerability is mitigated by rejecting any kset whose on-media size is larger than the remaining segment space before use.

This vulnerability could cause a kernel crash (BUG_ON) due to out-of-bounds memory access in the dm-pcache segment processing. While no direct exploitation details or privilege escalation are described, such a crash could lead to denial of service on affected systems.

A fix has been implemented in the Linux kernel to reject ksets that overrun their segment cache before processing. Users should update to the fixed kernel version once available. Patch status is not yet confirmed in the provided data—check the official Linux kernel advisories for the current remediation status.