CVE-2026-80960

Received Received - Intake

dm-pcache Out-of-Bounds Write in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg_num against the cache device size seg_num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache_seg_init() -> cache_dev_zero_range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg_num makes the segment allocations ZERO_SIZE_PTR. Reject a seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX before it is used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80960

EUVD

EUVD-2026-76283

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the dm-pcache module. It involves a lack of validation for the seg_num value read from the cache device's superblock. An attacker with CAP_SYS_ADMIN privileges can manipulate seg_num to exceed the cache device size, leading to an out-of-bounds write into kernel memory during cache initialization. This occurs because the kernel does not check seg_num against the device size before using it to allocate and initialize segments.

Detection Guidance

This vulnerability is specific to the Linux kernel's dm-pcache module and requires direct access to the system's kernel memory. Detection would typically involve inspecting kernel logs for unusual memory writes or crashes during cache device table loads. Commands like dmesg or journalctl may show errors related to dm-pcache or out-of-bounds memory access.

Impact Analysis

This vulnerability allows an attacker with CAP_SYS_ADMIN privileges to execute arbitrary code in the kernel, potentially leading to system compromise, data corruption, or denial of service. It could also enable privilege escalation if combined with other vulnerabilities. Systems using dm-pcache for caching are at risk.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patches are unavailable, restrict CAP_SYS_ADMIN capabilities to untrusted users to prevent exploitation. Monitor kernel logs for suspicious activity related to dm-pcache.

Hi! I’m here to help you understand CVE-2026-80960. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70