{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80958", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.809Z", "datePublished": "2026-09-11T19:42:25.861Z", "dateUpdated": "2026-09-11T19:42:25.861Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:42:25.861Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: clamp the tail kset read to the segment data region\n\nThe tail-kset read in cache_replay(), the writeback worker and the GC\nworker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment\nsize rather than the data region. A tail near the segment end reads past\nthe segment data into the following control area.\n\nClamp the read to cache_seg_remain(), the data region."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/dm-pcache/cache_gc.c", "drivers/md/dm-pcache/cache_key.c", "drivers/md/dm-pcache/cache_writeback.c"], "versions": [{"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0", "lessThan": "2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c", "status": "affected", "versionType": "git"}, {"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0", "lessThan": "1ab55354368d071ebaee4d8c82313955eab65a04", "status": "affected", "versionType": "git"}, {"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0", "lessThan": "becf07e2b0053027495ecd671b1f82fb2e615f68", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/dm-pcache/cache_gc.c", "drivers/md/dm-pcache/cache_key.c", "drivers/md/dm-pcache/cache_writeback.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c"}, {"url": "https://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04"}, {"url": "https://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68"}], "title": "dm-pcache: clamp the tail kset read to the segment data region", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/dm-pcache/cache_gc.c", "drivers/md/dm-pcache/cache_key.c", "drivers/md/dm-pcache/cache_writeback.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c", "status": "affected", "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0", "versionType": "git"}, {"lessThan": "1ab55354368d071ebaee4d8c82313955eab65a04", "status": "affected", "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0", "versionType": "git"}, {"lessThan": "becf07e2b0053027495ecd671b1f82fb2e615f68", "status": "affected", "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/dm-pcache/cache_gc.c", "drivers/md/dm-pcache/cache_key.c", "drivers/md/dm-pcache/cache_writeback.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: clamp the tail kset read to the segment data region\n\nThe tail-kset read in cache_replay(), the writeback worker and the GC\nworker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment\nsize rather than the data region. A tail near the segment end reads past\nthe segment data into the following control area.\n\nClamp the read to cache_seg_remain(), the data region."}], "id": "CVE-2026-80958", "lastModified": "2026-09-11T20:19:01.637", "metrics": {}, "published": "2026-09-11T20:19:01.637", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: dm-pcache out-of-bounds read vulnerability", "id": "2532108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532108"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the dm-pcache component of the Linux kernel. The tail-kset read operations, used by cache_replay(), the writeback worker, and the garbage collection (GC) worker, incorrectly calculate the length of the data region. This error causes the system to read beyond the intended segment data into an adjacent control area, which could lead to information disclosure or system instability."], "name": "CVE-2026-80958", "public_date": "2026-09-11T19:42:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80958\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80958\nhttps://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04\nhttps://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c\nhttps://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68"], "threat_severity": "Moderate"}

{}