CVE-2026-80955

Received Received - Intake

Use-After-Free in Linux Kernel dm-pcache

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug. Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid. Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-80955

EUVD

EUVD-2026-76278

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's device mapper (dm-pcache) component. It occurs in the kset_replay function when handling stale cache keys. The issue involves accessing freed memory (key->cache_pos.cache_seg) after calling cache_key_put(key), leading to potential memory corruption. Additionally, expired invalid keys are incorrectly processed, causing invalid segment operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's dm-pcache module and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using kernel debugging tools like ftrace or kprobes to monitor dm-pcache operations. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash, memory corruption, or potentially escalate privileges. Systems using affected Linux kernel versions with dm-pcache enabled may experience instability or security breaches if exploited.

Compliance Impact

This vulnerability is a use-after-free bug in the Linux kernel's dm-pcache module, which could lead to memory corruption or crashes. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, as it is a low-level system issue rather than a data handling or access control flaw.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the use-after-free and invalid segment operations in dm-pcache. Monitor kernel security advisories for patches addressing CVE-2026-80955.

Hi! I’m here to help you understand CVE-2026-80955. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70