HIGH Introduced in 6.18
dm-pcache TailPosition OOB
CVE-2026-80959
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI3.4LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cache_pos_decode() takes the persisted key_tail and dirty_tail seg_off from the cache device and addresses within the segment with it. A seg_off at or past the segment data_size, controllable by whoever supplies the device (CAP_SYS_ADMIN), reads past the segment data. Reject a decoded seg_off that is not below the segment data_size.
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_SYS_ADMIN can supply a crafted persistent cache device whose persisted tail-position offset exceeds the segment data boundary, causing out-of-bounds reads in kernel memory. The impact is limited to information disclosure and potential denial of service via kernel oops. The vulnerability requires privileged access to configure the device-mapper target and is not remotely exploitable.
Vulnerability analysis
The dm-pcache target decodes a persisted tail-position offset from the cache device and uses it to address data within a segment, but the original code never validates that the offset falls within the segment's valid data range. A cache device with a crafted offset at or past the segment data boundary causes the kernel to read beyond the segment's allocated data, leaking adjacent memory or triggering a fault. The fix rejects any decoded offset that is not strictly below the segment data size, returning an I/O error instead of proceeding with the invalid position. The vulnerable path is reachable only by someone who can supply and configure a cache device for a dm-pcache target, which requires CAP_SYS_ADMIN in the init namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.50 | ffd9a214a94f |
| 7.2 | 6.18 | 7.2.4 | 8bf7a06ca3c1 |
| mainline | 6.18 | 7.3 | d1898576090a |