CVE-2026-80961

Received Received - Intake

Buffer Overflow in Linux Kernel dm-pcache

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset key_num and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset key_num drives cache_kset_crc() and the replay loop in cache_replay(), the writeback worker and the GC worker, but only the magic and a fixed-seed CRC are checked first, so a non-last kset whose key_num exceeds the PCACHE_KSET_KEYS_MAX buffer reads past its end before the CRC compare. A key's intra-segment offset and length in cache_key_decode() are taken verbatim, so a key running past its segment is replayed into the cache tree and the data CRC check and every later read hit then copy adjacent persistent memory into the caller's bio -- an out-of-bounds read that leaks to user space. Both fields are controlled by whoever supplies the cache device (CAP_SYS_ADMIN); the CRC seed is public. Add kset_onmedia_valid() to bound key_num before any kset read, and reject a key whose offset plus length, computed in 64 bits, exceeds the segment data_size. Valid metadata is unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-80961

EUVD

EUVD-2026-76284

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the device-mapper (dm-pcache) subsystem. It involves two unbounded fields in cache device metadata: kset key_num and key intra-segment bounds. An attacker with CAP_SYS_ADMIN privileges can craft malicious cache device data that causes out-of-bounds reads, leaking adjacent persistent memory to userspace during cache operations.

Detection Guidance

This vulnerability affects the Linux kernel's dm-pcache module and requires access to the cache device configuration. Detection involves checking kernel logs for related errors or examining the dm-pcache module's behavior. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

If you run a system with the affected Linux kernel, an attacker with administrative privileges could exploit this to read sensitive kernel memory. This could expose passwords, encryption keys, or other confidential data. Normal users without admin rights cannot trigger this vulnerability.

Compliance Impact

This vulnerability involves an out-of-bounds read in the Linux kernel's dm-pcache module, which could lead to unauthorized access to adjacent persistent memory. While not directly tied to GDPR or HIPAA, such memory leaks could potentially expose sensitive data, violating confidentiality requirements under these regulations if exploited.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80961. Avoid using untrusted cache devices or ensure only trusted sources supply cache devices. Restrict CAP_SYS_ADMIN capabilities to prevent unauthorized access to cache device configuration.

Hi! I’m here to help you understand CVE-2026-80961. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70