CVE-2026-98868: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-98868 is a denial-of-service vulnerability in the Linux kernel's dm-pcache subsystem, caused by insufficient validation of kset on-media size against the remaining cache segment space. A forged key_num value in a kset can cause the computed size to exceed the segment's remaining space, causing cache_pos_advance() to trip a BUG_ON and crash the kernel. The vulnerability affects Linux kernel version 6.18 (introduced at commit 1d57628ff95b) and was disclosed on October 18, 2026. The CVSS base score is estimated as Medium (0.0 formally recorded by ENISA at time of publication) (GitHub Advisory, Feedly).

The root cause is a missing bounds check (related to CWE-20: Improper Input Validation) in the dm-pcache subsystem's cache_replay(), writeback worker, and GC worker functions. These functions read a kset of get_kset_onmedia_size() bytes and advance the cache position by that amount without first verifying that the size does not exceed cache_seg_remain(). An attacker who can supply or forge disk structures with a crafted key_num can cause the computed on-media size to exceed the segment boundary, triggering the cache_pos_advance() BUG_ON assertion and resulting in a kernel panic. The fix adds a validation step to reject any kset whose on-media size exceeds the remaining cache segment space before processing (GitHub Advisory).

Successful exploitation causes a kernel panic (system crash), resulting in a complete denial of service for the affected host. An attacker with local access to the storage backend or the ability to craft forged disk structures can crash any system running the vulnerable kernel version. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to the storage backend or the ability to craft forged on-disk structures, limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Patches are available in the Linux kernel stable tree via three commits: 01a700e9278da5706c865b9ca3ae70fdb7b4531d, 96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10, and 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb. Fixed versions include Linux kernel 6.18.52, 7.2.10, and 7.3-rc1 or later. Administrators should update to a patched kernel version and, as an interim measure, restrict unauthorized access to storage backend configurations and raw disk structures to reduce the risk of malicious kset injection (GitHub Advisory, Feedly).