CVE-2026-80962

Received Received - Intake

dm-pcache Out-of-Bounds Access in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache_info cache_segs_init() iterates cache_info->n_segs times indexing cache->segments[], which is sized to the cache device geometry, and get_seg_id() takes each segment id from the on-media cache_info and the per-segment next_seg link. Both come from cache device metadata that is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls them: an oversized n_segs or an out-of-range id drives an out-of-bounds access of cache->segments[] and a wild CACHE_DEV_SEGMENT() pointer into the device mapping -- an out-of-bounds read and write from on-disk data. Reject an n_segs that exceeds the device segment count and a segment id that is out of range before either is used. Valid metadata is unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-80962

EUVD

EUVD-2026-76285

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of geometry fields in the dm-pcache (device-mapper persistent cache) component. An attacker with CAP_SYS_ADMIN privileges can manipulate on-disk cache metadata to cause an out-of-bounds read and write in the kernel's memory by providing oversized segment counts or invalid segment IDs.

Detection Guidance

This vulnerability is specific to the Linux kernel's dm-pcache module and requires local access to the system. Detection involves checking kernel logs for related errors or examining the dm-pcache module for suspicious activity. Commands like dmesg | grep dm-pcache or checking /var/log/kern.log may help identify issues.

Impact Analysis

If exploited, this flaw could allow a local attacker with administrative privileges to crash the system, corrupt data, or potentially escalate privileges. It may also enable unauthorized access to sensitive kernel memory, leading to further security compromises.

Compliance Impact

This vulnerability allows an attacker with CAP_SYS_ADMIN privileges to manipulate on-disk metadata, potentially leading to out-of-bounds memory access. While it does not directly impact data privacy or security controls, it could enable unauthorized code execution or data corruption, indirectly affecting compliance with standards requiring system integrity and access controls.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. Avoid loading untrusted cache devices or restrict CAP_SYS_ADMIN capabilities to prevent exploitation. Monitor kernel logs for any signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-80962. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70