What is CVE-2026-98161?

CVE-2026-98161 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 5.3 onward and patched in 6.12.112, 6.18.52, 7.2.6 and others. CVE-2026-98161 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-98161?

CVE-2026-98161 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-98161?

Yes, CVE-2026-98161 has been patched. Fixed versions include 6.12.112, 6.18.52, 7.2.6 and others. If you are running Linux kernel 5.3 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-98161 actively exploited?

CVE-2026-98161 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-98161

Medium

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQ_FUA flush. That lets data writes run after a failed preflush and can complete the bio successfully despite the failed ordering barrier. Run the REQ_PREFLUSH flush synchronously before touching the bio data and complete the bio with the flush error if it fails. Keep asynchronous flush chaining for REQ_FUA. At that point, data copy has completed and the parent bio can wait for the chained flush bio.

Package Linux Kernel

Published 2026-09-25

Last modified 2026-10-03

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-754

CVE-2026-98161 is classified as CWE-754

See CWE-754 on MITRE CWE for full details on this weakness type.

Affected versions

Linux kernel versions 5.3 and later are affected. Fixed in 6.12.112, 6.18.52, 7.2.6, 7.3-rc1 and their respective stable series.

Affected from

≥ 5.3

Fixed in

✓ 6.12.112 6.12.x ✓ 6.18.52 6.18.x ✓ 7.2.6 7.2.x ✓ 7.3-rc1

References

4 total

Kernel Git
https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538

Patch
Kernel Git
https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb

Patch
Kernel Git
https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024

Patch
Kernel Git
https://git.kernel.org/stable/c/d34c30bc994328d9cf6749b2e9a32aabd08fd076

Details

CVE ID CVE-2026-98161

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-09-25

Modified 2026-10-03

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-98161?

CVE-2026-98161 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 5.3 onward and has been patched in 6.12.112, 6.18.52, 7.2.6 and others. CVE-2026-98161 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-98161?

CVE-2026-98161 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-98161?

Yes. CVE-2026-98161 has been patched. Fixed versions include 6.12.112, 6.18.52, 7.2.6 and others. If you are running Linux kernel 5.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-98161 actively exploited?

No. CVE-2026-98161 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.