CVE-2026-98867: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-98867 is an out-of-bounds write vulnerability in the Linux kernel's dm-pcache subsystem, caused by insufficient validation of logical key offsets read from persistent memory. The cache_key_decode() function accepts a key's logical offset from the cache device and uses it to index req_key_tree->subtrees[] in get_subtree() without bounds checking; an offset exceeding the device size results in an out-of-array pointer that rb_insert() writes through during replay. The vulnerability affects Linux kernel version 6.18 (introduced at commit 1d57628ff95b), and is fixed in versions 6.18.52, 7.2.10, and 7.3-rc1. Feedly estimates the severity as HIGH, while the EUVD-assigned base score is listed as 0.0 pending full NVD scoring (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE class: out-of-bounds write) in cache_key_decode() within the dm-pcache kernel module. When replaying cache entries from persistent memory, the function reads a key's off (offset) and len (length) fields without verifying that off + len (computed in 64 bits) stays within the device's bounds, nor that len is non-zero. A crafted persistent memory key with an oversized offset causes get_subtree() to compute a pointer outside the req_key_tree->subtrees[] array, and the subsequent rb_insert() call writes through that invalid pointer into arbitrary kernel memory. The fix rejects keys of zero length or whose off + len exceeds the device size before any use (GitHub Advisory, Kernel Patch 1).

Successful exploitation allows a local attacker with access to the dm-pcache persistent memory device to perform arbitrary kernel memory writes, which can lead to privilege escalation or kernel code execution. The integrity and availability of the affected system are at significant risk, as kernel memory corruption can result in system crashes or full compromise of the host. Confidentiality may also be affected if the attacker leverages code execution to access sensitive kernel or user-space data (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (October 18, 2026). The vulnerability requires local access to a dm-pcache persistent memory device, limiting the attack surface to privileged or semi-privileged local users. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

Update the Linux kernel to a patched version: 6.18.52, 7.2.10, or 7.3-rc1 and later. The upstream fix commits are 3d5a87cb909c, 1044970320007, and 97fc4b53dbe4. As a workaround where patching is not immediately possible, restrict access to dm-pcache persistent memory devices to trusted users only, reducing the local attack surface (GitHub Advisory, Kernel Patch 1).