HIGH Introduced in 6.18
dm-pcache CacheInfo OOB
CVE-2026-80962
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache_info cache_segs_init() iterates cache_info->n_segs times indexing cache->segments[], which is sized to the cache device geometry, and get_seg_id() takes each segment id from the on-media cache_info and the per-segment next_seg link. Both come from cache device metadata that is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls them: an oversized n_segs or an out-of-range id drives an out-of-bounds access of cache->segments[] and a wild CACHE_DEV_SEGMENT() pointer into the device mapping -- an out-of-bounds read and write from on-disk data. Reject an n_segs that exceeds the device segment count and a segment id that is out of range before either is used. Valid metadata is unaffected.
02KernelScan AI Analysis
Risk summary
A privileged operator who supplies a crafted cache device can trigger out-of-bounds reads and writes in the dm-pcache cache segment initialization path. The issue requires CAP_SYS_ADMIN to load a DM table and is reachable only on systems running the dm-pcache target introduced in kernel 6.18.
Vulnerability analysis
The dm-pcache cache initialization reads segment counts and segment identifiers directly from on-disk cache metadata without validating them against the actual cache device geometry. An attacker who controls the cache device contents can set an oversized segment count or an out-of-range segment id, causing the kernel to index past the allocated segment array and compute a wild pointer into the device mapping, resulting in out-of-bounds reads and writes. The fix adds bounds checks that reject any segment count exceeding the device segment count and any segment id outside the valid range before they are used. The vulnerable path is reached when a user with CAP_SYS_ADMIN loads a DM table pointing at a crafted cache device, so it requires privileged access on the host.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.50 | ab5dcde6fa96 |
| 7.2 | 6.18 | 7.2.4 | 3e19172089ec |
| mainline | 6.18 | 7.3 | 32d1809da310 |