Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98867

dm-pcache: bound the logical key offset from persistent memory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in get_subtree(). An off past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay. Reject a key of zero length, or whose off+len (computed in 64 bits) exceeds the device size, before it is used.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 to < 3d5a87cb909c1f375f08065b20123fa5db5958d8affected
  • 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 to < 10449703200076980704894c3d68d6796182371baffected
  • 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 to < 97fc4b53dbe4a983fdf093243067fa6a64562307affected

Linux Linux

Default version status: affected

  • 6.18affected
  • 0 to < 6.18unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.10 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References