The dm‑pcache module in the Linux kernel contains a flaw that allows an attacker to forge a key identifier such that the calculated on‑media size exceeds the remaining space in a cache segment. When the kernel processes this forged key, it reads past the end of the segment, triggers an internal BUG_ON, and crashes the kernel. The resulting kernel panic leads to an immediate denial of service even though no data is corrupted, as only the operating system is disrupted.

All Linux kernel releases prior to the commit that adds a check against overrunning the cache segment. The vulnerability applies to the generic dm‑pcache implementation and therefore affects every distribution that ships an unpatched kernel in which dm‑pcache is enabled.

The vulnerability is a classic out‑of‑bounds memory access that can be exploited to crash the system. Attackers must craft a kset with a forged key number that causes the segment overrun; this likely requires interaction with the dm‑pcache interface, which is normally available to privileged or userspace programs that manage device-mapper caches. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, so the current exploitation probability is unclear, but the potential impact of a kernel panic is high. Defensive mitigation therefore involves ensuring the kernel is patched before the system is exposed to untrusted input that may reach the dm‑pcache subsystem.