CVE-2026-98161: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98161 is a data ordering flaw in the Linux kernel's nvdimm (Non-Volatile DIMM) pmem subsystem, specifically within the pmem_submit_bio() function. The vulnerability allows data writes to proceed to persistent memory after a failed REQ_PREFLUSH cache flush ordering barrier, potentially completing a bio operation successfully despite the failed barrier. It affects Linux kernel versions prior to 6.18.52 and 7.2.6 (with fixes also targeting specific git commits). The vulnerability was published on September 25, 2026, and carries an estimated CVSS severity of Medium (GitHub Advisory, Feedly).

The root cause is improper error handling in pmem_submit_bio() within the Linux kernel's nvdimm pmem driver. When a REQ_PREFLUSH operation fails, the function records the error but continues to copy bio data; a subsequent successful REQ_FUA flush can then overwrite the recorded error, allowing the bio to complete successfully despite the failed ordering barrier. The fix enforces synchronous execution of REQ_PREFLUSH before any bio data is touched, completing the bio with the flush error if the preflush fails, while retaining asynchronous flush chaining for REQ_FUA after data copy completes. No CWE classification has been formally assigned to this vulnerability (GitHub Advisory, Kernel Commit).

Successful exploitation can violate data consistency and ordering guarantees on systems using nvdimm persistent memory devices. A local user with write access to such devices can trigger bio write operations that bypass the cache flush ordering barrier, potentially resulting in data corruption or inconsistent state in persistent memory. This primarily affects integrity and availability of data stored on NVDIMM-backed storage, with no direct confidentiality impact reported (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The vulnerability requires local access with write permissions to nvdimm persistent memory devices, significantly limiting the attack surface. The EPSS score is approximately 0.155%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

Update the Linux kernel to a patched version: 6.18.52 or later, or 7.2.6 or later. For systems requiring specific commit-level patches, apply commits c644a2f8fef5618fcf453c591177700fd07dd024, 770a90c2127220f0fc194ce909ad4f0842e141cb, or 72561ca1ab96f0f0f32737a6171641e05a318538 depending on the kernel branch in use. No configuration-based workaround is documented; upgrading to a fixed kernel version is the recommended remediation (GitHub Advisory, Kernel Commit).