CVE-2026-80960

dm-pcache: validate on-media seg_num against the cache device size

Published Sep 11, 2026 CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate on-media seg_num against the cache device size

seg_num is read from the crc32c-only superblock, so whoever supplies the
cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes
cache->segments[] and is the value every later on-media segment id is
bounded against, yet it is never checked against the device. Because
cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for
a segment id past the device resolves to ordinary kernel memory beyond
the mapping; a new-cache init reaching such an id has cache_seg_init() ->
cache_dev_zero_range() memset() 12 KiB over that memory -- an
out-of-bounds write into the kernel heap at table load. A zero seg_num
makes the segment allocations ZERO_SIZE_PTR.

Reject a seg_num that is zero, larger than the device can hold, or larger
than PCACHE_CACHE_SEGS_MAX before it is used.

Analysis

Technical impact

During a device‑mapper table load, a privileged user supplies a cache device whose superblock contains a value called seg_num. That value is used to size an array that bounds future segment identifiers, but it is not validated against the device’s actual capacity. When a segment id beyond the mapping range is accessed, the kernel performs a 12 KiB memset that writes past the end of the mapped device into arbitrary kernel heap memory. This out‑of‑bounds write (CWE‑787) corrupts kernel memory and can lead to arbitrary code execution with root privileges.

Affected Systems

All Linux kernel builds that include the dm‑pcache module are potentially impacted; no specific release versions are listed in the advisory. The flaw exists in every distribution that ships a kernel version containing the affected pcache code path.

Risk and Exploitability

The CVSS score of 5.7 indicates medium severity, while the EPSS score of < 1% suggests a low probability of exploitation. The bug requires CAP_SYS_ADMIN and can only be triggered locally. If exploited, heap corruption can lead to privilege escalation to root. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< 91b93fe5cf4d62d5ecc642a6c8f15a3c11b00e3c
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< e889c0ee81165fc90aad2979b51f930f77895703
`1d57628ff95b32d5cfa8d8f50e07690c161e9cf0`	affected	< 62d92e45abe9e087370f9fc5d876b95673aced34

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,91b93fe5cf4d62d5ecc642a6c8f15a3c11b00e3c)`	affected	code_commit	—
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,e889c0ee81165fc90aad2979b51f930f77895703)`	affected	code_commit	—
`[1d57628ff95b32d5cfa8d8f50e07690c161e9cf0,62d92e45abe9e087370f9fc5d876b95673aced34)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the patch referenced in the advisory
Ifpcache module or remove the privilege of CAP_SYS_ADMIN for the affected user.
Monitor system logs for signs of memory corruption or unrelated kernel crashes.

Generated by OpenCVE AI on September 21, 2026 at 02:32 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/62d92e45abe9e087370f9fc5d876b95673aced34
https://git.kernel.org/stable/c/91b93fe5cf4d62d5ecc642a6c8f15a3c11b00e3c
https://git.kernel.org/stable/c/e889c0ee81165fc90aad2979b51f930f77895703
https://nvd.nist.gov/vuln/detail/CVE-2026-80960
https://www.cve.org/CVERecord?id=CVE-2026-80960

History

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80960 https://www.cve.org/CVERecord?id=CVE-2026-80960
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg_num against the cache device size seg_num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache_seg_init() -> cache_dev_zero_range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg_num makes the segment allocations ZERO_SIZE_PTR. Reject a seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX before it is used.
Title		dm-pcache: validate on-media seg_num against the cache device size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/62d92e45abe9e087370f9fc5d876b95673aced34 https://git.kernel.org/stable/c/91b93fe5cf4d62d5ecc642a6c8f15a3c11b00e3c https://git.kernel.org/stable/c/e889c0ee81165fc90aad2979b51f930f77895703