A null pointer dereference occurs while parsing optional arguments for the dm-pcache target in the Linux kernel. If a target advertises an option name but no value—e.g. "cache_mode" without a corresponding value—the parser consumes the name, then attempts to fetch a non‑existent value. The resulting NULL pointer is dere in a strcmp call, leading to a kernel oops or crash. The flaw allows any malformed table that reaches the dm‑pcache target to trigger a controlled failure during target construction, potentially exposing the system to a denial of service. Because the parsing occurs at kernel level, the impact is local to the administrator or privileged process that creates or modifies the target, but a crash can disrupt all users of that kernel.

All Linux kernel releases that include the dm-pcache module before the recent fix are affected. Systems that load the dm-pcache target and can supply custom configuration tables—such as those using device‑mapper’s persistent cache feature—are at risk. The vulnerability is present regardless of kernel ABI version; any kernel employing dm-pcache without the patch can be impacted.

The CVSS score is 5.5, EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The information suggests that exploitation requires local privileged access to create a dm‑pcache target or to load a kernel module that configures it. An attacker would need to supply a malformed configuration table, which is possible only from a user that can modify device‑mapper settings. The resulting kernel crash leads to a denial of service that affects all users of the compromised kernel. Thus, the risk is significant for environments where dm‑pcache is enabled and can be manipulated by a trusted user, but remote exploitation remains unlikely.