CVE-2026-98868

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: reject a kset that overruns its segment

cache replay(), the writeback worker and the GC worker read a kset of get kset onmedia size() bytes and advance the position by it. A forged key num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache pos advance() BUG ON.

Reject a kset whose on-media size exceeds cache seg remain() before use.