CVE-2026-80959

Received Received - Intake

dm-cache Persisted Tail-Position Offset Out-of-Bounds Read in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cache_pos_decode() takes the persisted key_tail and dirty_tail seg_off from the cache device and addresses within the segment with it. A seg_off at or past the segment data_size, controllable by whoever supplies the device (CAP_SYS_ADMIN), reads past the segment data. Reject a decoded seg_off that is not below the segment data_size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80959

EUVD

EUVD-2026-76282

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the dm-pcache module where cache_pos_decode() incorrectly handles persisted tail-position offsets. It allows reading past segment data if seg_off is at or past the segment data_size, which can be controlled by a user with CAP_SYS_ADMIN privileges.

Impact Analysis

An attacker with CAP_SYS_ADMIN privileges could exploit this to read sensitive data beyond intended memory boundaries, potentially leading to information disclosure or system instability.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Ensure only trusted users have CAP_SYS_ADMIN privileges to prevent malicious device supply.

Hi! I’m here to help you understand CVE-2026-80959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70