HIGH Introduced in 6.18
dm-pcache KsetReplay UAF
CVE-2026-80955
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug. Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid. Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.
02KernelScan AI Analysis
Risk summary
A use-after-free exists in the dm-pcache persistent cache target's key replay path. When a cache key's segment generation is stale, the key is freed but its segment pointer is subsequently dereferenced, and invalid keys incorrectly update the segment bitmap and reference count. Exploitation requires root or CAP_SYS_ADMIN to configure a device-mapper target, limiting the attack surface to privileged local users.
Vulnerability analysis
During cache metadata replay, when a key's segment generation is stale, the code frees that key but then immediately accesses the freed memory to update a segment reference. Expired keys also incorrectly mark segments as active in a tracking bitmap before the validity check. The fix moves the validity check ahead so invalid keys are skipped before any segment update or reference operation occurs. This path is only reachable while initializing a dm-pcache device-mapper target, which requires CAP_SYS_ADMIN in the initial user namespace, limiting exposure to privileged local users.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.50 | 1894fc7a3bab |
| 7.2 | 6.18 | 7.2.4 | f39a3e9cc594 |
| mainline | 6.18 | 7.3 | c2e894eac398 |