HIGH Introduced in 6.18
dm-pcache TailKset OOB
CVE-2026-80958
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache_replay(), the writeback worker and the GC worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area. Clamp the read to cache_seg_remain(), the data region.
02KernelScan AI Analysis
Risk summary
A bounded out-of-bounds read in the dm-pcache device-mapper target reads past the segment data region into the adjacent control area during cache replay, writeback, and garbage collection. The misinterpreted control-area data can cause incorrect cache operations or a kernel crash. Only systems with a configured dm-pcache target (requiring root-level device-mapper access) are affected.
Vulnerability analysis
The dm-pcache persistent cache target reads tail key-set entries from persistent-memory segments during cache replay, writeback, and garbage collection. The read length is bounded by the raw segment size rather than the actual data region, so when a tail key-set sits near the end of a segment the read extends past the data area into the adjacent control area. The fix clamps the read to the data region boundary, preventing the over-read. This path is reachable only after a privileged operator configures a dm-pcache target, which requires root-level device-mapper access on the local machine.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.50 | 2cd9776fe3f2 |
| 7.2 | 6.18 | 7.2.4 | 1ab55354368d |
| mainline | 6.18 | 7.3-rc1 | becf07e2b005 |