CVE-2026-80955

dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

In kset_replay, when key->seg_gen is stale (key->seg_gen <
key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then
key->cache_pos.cache_seg is accessed as the argument to cache_seg_get().
This is a use-after-free on the freed key memory. Although mempool
recycled memory is not immediately reclaimed or overwritten in practice,
this is still a potential UAF bug.

Additionally, for expired invalid keys, setting the cache->seg_map bit
and calling cache_seg_get() is unreasonable since the corresponding
segment data is no longer valid.

Fix both issues by moving cache_seg_get() and __set_bit() after the
gen check, so they only execute for valid keys, and using continue to
skip invalid keys.

Analysis

Technical impact

This vulnerability is a use‑after‑free and invalid segment operation in the dm‑pcache key replay path of the Linux kernel. When a key’s generation is stale, a freed memory block is accessed, creating a use‑after‑free condition that can corrupt kernel memory. The flaw, identified as CWE‑825, could lead to a system crash or unintended kernel data manipulation. No explicit capability for privilege escalation or arbitrary code execution is documented in the given description.

Affected Systems

All Linux kernel builds that include the dm‑pcache subsystem and have not yet applied the recent patch are affected. The issue exists in kernel releases that use the pre‑patch implementation of kset_replay().

Risk and Exploitability

The CVSS score of 7.8 indicates moderate‑to‑high impact. EPSS is < 1% and the vulnerability is not listed in CISA KEV. The likely attack vector requires local or privileged access to trigger the cache replay logic, limiting immediate exploitation risk. Successful exploitation would cause kernel memory corruption, potentially leading to system instability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< 1894fc7a3bab90143dcd26ef8ee27040ef4a7501
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< f39a3e9cc5946473e16d6f5071b2ee0216c56d06
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< c2e894eac398b258f12fdec73ed6ba081047f7b3

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,1894fc7a3bab90143dcd26ef8ee27040ef4a7501)`	affected	code_commit	—
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,f39a3e9cc5946473e16d6f5071b2ee0216c56d06)`	affected	code_commit	—
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,c2e894eac398b258f12fdec73ed6ba081047f7b3)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the dm‑pcache use‑after‑free fix (e.g., update to a kernel version containing commit 1894fc7a3bab90143dcd26ef8ee27040ef4a7501).
Reboot the system so that the updated kernel is loaded into memory.
If updating immediately is not possible, temporarily disable the dm‑pcache module with 'modprobe -r dm_pcache' or prevent it from loading via kernel boot parameters.

Generated by OpenCVE AI on September 21, 2026 at 02:49 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501
https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3
https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06
https://nvd.nist.gov/vuln/detail/CVE-2026-80955
https://www.cve.org/CVERecord?id=CVE-2026-80955

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80955 https://www.cve.org/CVERecord?id=CVE-2026-80955
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug. Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid. Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.
Title		dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501 https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3 https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06