CVE-2026-80955 - Vulnerability Details

- dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

In kset_replay, when key->seg_gen is stale (key->seg_gen <
key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then
key->cache_pos.cache_seg is accessed as the argument to cache_seg_get().
This is a use-after-free on the freed key memory. Although mempool
recycled memory is not immediately reclaimed or overwritten in practice,
this is still a potential UAF bug.

Additionally, for expired invalid keys, setting the cache->seg_map bit
and calling cache_seg_get() is unreasonable since the corresponding
segment data is no longer valid.

Fix both issues by moving cache_seg_get() and __set_bit() after the
gen check, so they only execute for valid keys, and using continue to
skip invalid keys.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a use‑after‑free and invalid segment operation in the dm‑pcache key replay path of the Linux kernel. When a key’s generation is stale, a freed memory block is accessed, creating a use‑after‑free condition that can corrupt kernel memory. The flaw, identified as CWE‑825, could lead to a system crash or unintended kernel data manipulation. No explicit capability for privilege escalation or arbitrary code execution is documented in the given description.

Affected Systems

All Linux kernel builds that include the dm‑pcache subsystem and have not yet applied the recent patch are affected. The issue exists in kernel releases that use the pre‑patch implementation of kset_replay().

Risk and Exploitability

The CVSS score of 7.8 indicates moderate‑to‑high impact. EPSS is < 1% and the vulnerability is not listed in CISA KEV. The likely attack vector requires local or privileged access to trigger the cache replay logic, limiting immediate exploitation risk. Successful exploitation would cause kernel memory corruption, potentially leading to system instability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< 1894fc7a3bab90143dcd26ef8ee27040ef4a7501
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< f39a3e9cc5946473e16d6f5071b2ee0216c56d06
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< c2e894eac398b258f12fdec73ed6ba081047f7b3

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,1894fc7a3bab90143dcd26ef8ee27040ef4a7501)`	affected	code_commit	—
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,f39a3e9cc5946473e16d6f5071b2ee0216c56d06)`	affected	code_commit	—
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,c2e894eac398b258f12fdec73ed6ba081047f7b3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the dm‑pcache use‑after‑free fix (e.g., update to a kernel version containing commit 1894fc7a3bab90143dcd26ef8ee27040ef4a7501).
Reboot the system so that the updated kernel is loaded into memory.
If updating immediately is not possible, temporarily disable the dm‑pcache module with 'modprobe -r dm_pcache' or prevent it from loading via kernel boot parameters.

Generated by OpenCVE AI on September 21, 2026 at 02:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501
https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3
https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06
https://nvd.nist.gov/vuln/detail/CVE-2026-80955
https://www.cve.org/CVERecord?id=CVE-2026-80955

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80955 https://www.cve.org/CVERecord?id=CVE-2026-80955
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug. Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid. Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.
Title		dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501 https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3 https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:23.838Z

Updated: 2026-09-13T06:28:29.166Z

Reserved: 2026-08-26T14:34:25.804Z

Link: CVE-2026-80955

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:01.287

Modified: 2026-09-13T07:17:02.700

Link: CVE-2026-80955

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:23Z

Links: CVE-2026-80955 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T03:00:12Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object