CVE-2026-98161

Executive Summary

CVE-2026-98161 is a correctness and ordering-barrier defect in the Linux kernel NVDIMM persistent-memory (pmem) block device driver, specifically in pmem_submit_bio(). The function records a REQ_PREFLUSH error but continues to copy bio data and may subsequently overwrite the recorded error with a successful REQ_FUA flush, allowing data writes to complete successfully even though a preceding hardware cache flush failed. This affects Linux systems using NVDIMM/pmem block devices (for example, Intel Optane persistent memory exposed as /dev/pmem*) that rely on preflush ordering for write durability and crash consistency. The impact is a silent durability and data-integrity failure rather than remote code execution: data that an application believes is durably ordered on persistent media may be lost or reordered after a power failure or crash. No public exploit code, PoC, or Nuclei template exists, and no CVSS score has been assigned by NVD.

Technical Analysis

The Linux block layer uses request flags to express ordering and durability barriers on top of storage hardware:

• REQ_PREFLUSH — a barrier that requires the storage device to flush volatile write caches before the accompanying data is written. It is the mechanism that makes atomicity and ordering guarantees of higher-level subsystems (for example, a filesystem journal commit or an fsync-style barrier) meaningful on hardware with volatile caches.
• REQ_FUA — "Force Unit Access," which requires the specific write to reach persistent media before the request is reported complete, without necessarily flushing the whole device cache.

Per the NVD description, the defect in pmem_submit_bio() is a control-flow and error-handling error:

1. The function records an error when a REQ_PREFLUSH flush fails, but does not stop processing — it "continues to copy the bio data."
2. Because processing continues, a later REQ_FUA flush that succeeds "can later overwrite the error with a successful REQ_FUA flush."
3. The net effect: "data writes run after a failed preflush and can complete the bio successfully despite the failed ordering barrier."

The corrected behavior described by the upstream fix is:

• Run the REQ_PREFLUSH flush synchronously and do not touch the bio data until that flush has succeeded. If it fails, complete the bio immediately with the flush error and never issue the data write.
• Retain asynchronous flush chaining for the REQ_FUA case, where the data copy has already completed and the parent bio can wait on a chained flush bio.

This is fundamentally an improper handling of an exceptional condition (CWE-703): an error condition is detected and stored, but not acted upon before irreversible side effects (the data copy and submission of the write) proceed. The result is a violation of the barrier contract between the block layer and the device driver.

Two properties make this subtle and dangerous:

• Silent failure. The bio is completed successfully, so no error is propagated to the filesystem, the application, or the operator. Upper layers have no signal that the ordering guarantee was violated.
• Latent data loss. The consequence only manifests after a crash or power loss, when the volatile device cache that should have been flushed first is not. This makes root-causing exceptionally difficult — the symptom (corrupted or rolled-back journal, torn metadata) appears far from the cause (a transient flush error during a write).

No CVSS score was assigned by NVD (score: N/A), no CWE was officially assigned by the CNA in the supplied data, and no affected version range was provided. The severity framing above is derived strictly from the described failure mode: local-only reachability (requires a pmem/NVDIMM device present), high attack complexity (requires inducing a flush failure at the right moment), high privileges (kernel-level device/driver interaction), and impact limited to integrity and availability of persistent data, with no confidentiality exposure.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-98161; the attack chain below is inferred from the vulnerability class (faulty storage barrier / improper error handling) and the specific mechanism described in the NVD entry. No function names, paths, or parameters beyond those in the description are assumed.

1) Reconnaissance / target identification. An attacker (or a fault-injection researcher) first determines whether the target system exposes an NVDIMM/pmem block device. This is a local prerequisite: the affected code path is reached only when a bio is submitted to a pmem-backed block device with a REQ_PREFLUSH barrier — typically from a filesystem journal commit, a database fsync, or any application that issues an ordering barrier. The attacker profile is therefore an actor with existing local access to the machine (co-tenanted VM, container with device access, or a user on a system with a pmem namespace), not a remote network attacker.

2) Triggering the flaw class. The vulnerability is triggered when the device's preflush operation fails but the driver continues to process the bio. In practice such a flush failure would arise from a storage-level fault: a device that reports a flush error, a simulated/fault-injected error on the pmem device, or hardware that returns an error on the cache-flush command. The attacker's goal is to cause — or take advantage of — a REQ_PREFLUSH failure during a write that also carries REQ_FUA. Because the error is only recorded and not acted upon before the data copy, the subsequent successful FUA flush overwrites the recorded error and the bio completes successfully.

3) Execution method (vulnerability-class level). There is no crafted network payload or code-execution primitive here. The "weaponization" is a fault/ordering manipulation: an actor with the ability to induce or exploit a transient flush error can cause a data write to be reported as durable when the required preflush never succeeded. At the class level this is a logic/error-handling flaw that defeats a durability barrier — conceptually similar to other "error swallowed and overwritten" storage bugs. Because no specific function names, offsets, or device-specific command parameters are provided in the source data, no lower-level payload is described.

4) Post-exploitation impact. Exploitation yields no code execution and no data disclosure. The impact is state corruption and denial of durability:

• Filesystem journals, databases, and any write-ahead-logging layer that depends on preflush ordering may be silently inconsistent after a crash or power loss.
• An attacker with local access and the ability to induce flush failures can selectively cause metadata/journal corruption that is not detectable until reboot — potentially reverting committed transactions, corrupting persistent data structures, or causing applications to fail closed/open on restart.
• In multi-tenant or shared-pmem scenarios this can be used to degrade integrity guarantees of another workload's persistent store.

Caveat: Because no CVE-specific PoC, exploit framework, or in-the-wild reporting exists, all of the above is a class-level inference. The absence of a public exploit and the local, high-complexity nature of the trigger make opportunistic mass exploitation unlikely.

Impact Assessment

• Confidentiality: None. The flaw concerns write ordering and durability, not read authorization or memory disclosure.
• Integrity: Low-to-Moderate. The core defect is that data writes can be treated as durably ordered when they are not. This is an integrity failure of persistent state that surfaces after a crash.
• Availability: Low-to-Moderate. Corruption of persistent structures can render a filesystem, journal, or database unavailable after an unclean shutdown.
• Attack Vector: Local. Requires a pmem/NVDIMM device and the ability to reach the affected submit-bio path.
• Attack Complexity: High. Requires inducing a REQ_PREFLUSH failure at the correct point in the write path.
• Privileges Required: High. The affected subsystem is kernel/device-level.
• Blast radius: Any Linux system that (a) runs a kernel containing this defect and (b) uses NVDIMM/pmem block devices with preflush-ordered writes. General-purpose servers without persistent memory are not exposed to this code path. Because the affected version range was not supplied, the population of vulnerable kernels cannot be enumerated from the available data.
• Business impact: Silent data-integrity failure in high-value persistent-memory workloads (in-memory databases, journaling filesystems on pmem, low-latency transaction logs). Operators may experience unexplained post-crash corruption with no kernel error trail, complicating incident response and root-cause analysis.

No CVSS score was published by NVD for this CVE (N/A), so the vector above is a derived estimate based on the described mechanism and is provided for contextual severity framing only; it should not be treated as an authoritative score.

Detection Guidance

Detection for this vulnerability is difficult because exploitation is silent and local — no network signature exists. The most reliable signals are kernel-level: device-mapper/NVDIMM driver traces, block-layer error counters, and post-crash filesystem-journal anomaly detection. The rules below focus on detecting the conditions and symptoms (driver flush errors, pmem device access, barrier-related error paths) at the class level.

Sigma Rule

title: Linux pmem/NVDIMM Flush Error Observed Around Block Write (CVE-2026-98161)
id: 8b1f2c40-9816-4116-a1e0-3c2f0a98161a
status: experimental
description: Detects kernel messages indicating a failed preflush/cache-flush on an
  NVDIMM/pmem device, which is the precondition for the pmem write-ordering flaw.
  Symptom-level detection only; no PoC exists.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98161
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kern
detection:
  selection_pmem:
    - 'pmem'
    - 'nvdimm'
    - 'libnvdimm'
  selection_error:
    - 'flush'
    - 'PREFLUSH'
    - 'FUA'
    - 'I/O error'
    - 'failed'
  condition: selection_pmem and selection_error
falsepositives:
  - Legitimate device errors and hardware faults
  - Kernel module load/unload messages
level: low
tags:
  - attack.t1211

YARA Rule

rule CVE_2026_98161_pmem_preflush_ordering_strings
{
    meta:
        description = "Detects Linux kernel sources/binaries referencing pmem_submit_bio and REQ_PREFLUSH/REQ_FUA ordering-barrier logic (CVE-2026-98161). String-level indicator only."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98161"
        date = "2026-01-01"

    strings:
        $fn  = "pmem_submit_bio" ascii
        $pf  = "REQ_PREFLUSH"    ascii
        $fua = "REQ_FUA"         ascii
        $mod = "nvdimm"          ascii

    condition:
        $fn and $pf and $fua
}

Suricata IDS Rule

# No network-reachable attack surface exists for CVE-2026-98161 (local kernel
# block-device ordering flaw). The rule below is a best-effort, low-value
# placeholder that alerts on pmem/NVDIMM-related strings in traffic and SHOULD
# NOT be relied upon as a real detection for this vulnerability.
alert tcp any any -> any any (msg:"INFORMATIONAL - CVE-2026-98161 pmem/NVDIMM artifact string in traffic (no remote primitive, low fidelity)"; flow:to_server,established; content:"pmem"; nocase; content:"REQ_PREFLUSH"; nocase; distance:0; classtype:policy-violation; sid:9800161; rev:1;)

Elastic Detection

// EQL — correlate a pmem device flush error with a subsequent successful write
// completion on the same host. Symptom-level detection for CVE-2026-98161.
sequence by host.name with maxspan=30s
  [ logs-linux.kernel where message : "*pmem*" and message : ("*flush*" or "*PREFLUSH*") and message : ("*error*" or "*failed*") ]
  [ logs-linux.kernel where message : "*REQ_FUA*" or message : ("*pmem*" and "*complet*") ]

Splunk SPL Query

index=linux_logs (message="*pmem*" OR message="*nvdimm*")
  (message="*flush*" OR message="*PREFLUSH*" OR message="*FUA*")
  (message="*error*" OR message="*failed*" OR message="*I/O error*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="linux,cve-2026-98161,pmem">
  <rule id="981610" level="6">
    <decoded_as>syslog</decoded_as>
    <match>pmem|nvdimm|libnvdimm</match>
    <regex>flush|PREFLUSH|REQ_FUA|I/O error|failed</regex>
    <description>CVE-2026-98161: pmem/NVDIMM flush error or ordering-barrier anomaly observed on $(hostname)</description>
    <mitre>
      <id>T1211</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range was provided in the available data. The guidance below is generic to the vulnerability class and must be validated against an authoritative kernel update before deployment.

1) Immediate mitigations (no patch available):

• Restrict local access to NVDIMM/pmem block devices. Ensure only trusted, privileged workloads can issue writes with ordering barriers to /dev/pmem* and ensure container/VM device passthrough does not grant untrusted tenants direct pmem access.
• Avoid relying on a single NVDIMM/pmem device for durability-critical journals where a flush error could silently corrupt state; prefer redundant, replication-based durability (for example, synchronous replication to a second node) so that a silent local ordering failure does not become data loss.
• Monitor kernel and NVDIMM driver logs aggressively for flush/PREFLUSH errors (see Detection Guidance) and treat any such error as a potential integrity incident requiring verification (fsck, journal replay checks).
• Where pmem ordering guarantees are critical, consider temporarily disabling write-cache buffers on the device (e.g., selecting a device/driver configuration that does not rely on volatile cache) or relocating durability-critical data to a storage stack known to honor preflush semantics.
• Reduce the attack surface by minimizing locally interactive users and applying least privilege on hosts with persistent memory.

2) Patch/upgrade steps:

• There is currently no patch reference from any tracked source. Monitor the upstream Linux kernel git log for changes to pmem_submit_bio() addressing REQ_PREFLUSH/REQ_FUA ordering and error propagation, and track the NVD entry for updates to affected versions and CWE assignment.
• When a fix is published by the kernel maintainers or a distribution vendor, apply the corresponding kernel update and reboot. Because this is a kernel-level defect, a reboot is required; verify the running kernel matches the fixed build (uname -r).
• After patching, re-validate durability behavior for any application that depends on preflush ordering.

3) Long-term hardening:

• Establish a patch-management process that tracks kernel (not just userland) CVEs and maps them to the specific subsystems in use.
• Adopt fault-injection testing for storage error paths in CI so that "error swallowed and overwritten" defects are caught before production.
• Enforce telemetry on device flush errors and treat them as first-class availability/integrity signals, not merely warnings.
• Maintain regular, verified backups of persistent-memory workloads; a silent durability failure is only recoverable if a good, independent copy exists.

References

• NVD — CVE-2026-98161: https://nvd.nist.gov/vuln/detail/CVE-2026-98161
• Linux kernel block layer / NVDIMM (libnvdimm) subsystem documentation: https://docs.kernel.org/ and https://git.kernel.org/ (track commits touching pmem_submit_bio() and REQ_PREFLUSH/REQ_FUA handling)
• CWE-703 — Improper Check or Handling of Exceptional Conditions: https://cwe.mitre.org/data/definitions/703.html
• MITRE ATT&CK T1211 — Exploitation for Defense Evasion: https://attack.mitre.org/techniques/T1211/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-98161 is not listed; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation was identified for this CVE at the time of writing. No threat-actor campaign has been associated with it.