CVE-2026-98868
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it. A forged key_num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache_pos_advance() BUG_ON. Reject a kset whose on-media size exceeds cache_seg_remain() before use.
Affected versions
Linux kernel versions
6.18
and later are affected. Fixed in
6.18.52,
7.2.10,
7.3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-98868?
CVE-2026-98868 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.18 onward and has been patched in 6.18.52, 7.2.10 and 7.3. CVE-2026-98868 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98868?
Yes. CVE-2026-98868 has been patched. Fixed versions include 6.18.52, 7.2.10 and 7.3. If you are running Linux kernel 6.18 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98868 actively exploited?
No. CVE-2026-98868 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.