CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

CVE-2026-98867

The Linux kernel is affected by a vulnerability in dm-pcache where the cache_key_decode() function fails to properly validate the logical offset of a key from persistent memory. An offset exceeding the device size allows the creation of a subtree pointer outside the req_key_tree->subtrees[] ar...

ZoneClaw-code

ZoneClaw Experiment code for ZoneClaw: Mitigating Persistent Memory Attack by Establishing Memory-Zoning among OpenClaw-Style Computer-Use Agents. This repository contains the benchmark tasks, defense implementations, and evaluation scripts used in the paper. The benchmark studies cross-session...

ZoneClaw: Mitigating Persistent Memory Attacks by Establishing Memory-Zoning in OpenClaw-Style Computer-Use Agents

Computer-use agents increasingly operate as long-running assistants through persistent workspace memory, which OpenClaw-style CUAs realize as automatically reloaded files that hold user instructions, system summaries, and external claims at the same privilege level. Here, remembering a claim...

CVE-2026-100592

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2026-100592 OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2026-100592 OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2026-100592

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

EUVD-2026-87459

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2026-100592: Missing Authorization

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2026-93201: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-80961

A flaw was found in the dm-pcache component of the Linux kernel. A local attacker with CAPSYSADMIN capabilities could exploit unbounded fields decoded from the cache device. This could lead to an out-of-bounds read, potentially disclosing sensitive information from adjacent persistent memory to...

DEBIAN-CVE-2026-80961

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

UBUNTU-CVE-2026-80961

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

CVE-2026-80961

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

CVE-2026-80961 dm-pcache: validate kset key_num and intra-segment bounds

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

CVE-2026-80961 dm-pcache: validate kset key_num and intra-segment bounds

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

CVE-2026-80961

CVE-2026-80961 affects the dm-pcache (Device-Mapper Persistent Cache) component of the Linux kernel . Two fields decoded from the cache device are left unbounded: the kset key_num , which can exceed the PCACHE_KSET_KEYS_MAX buffer before the CRC comparison, and the key's intra-segment offset and ...

EUVD-2026-76284

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

PT-2026-90091

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the dm-pcache component where two fields decoded from the cache device are not properly bounded. The key num field, which drives cache kset crc and...