CVE-2026-80960

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate on-media seg_num against the cache device size

seg_num is read from the crc32c-only superblock, so whoever supplies the

cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes

cache->segments[] and is the value every later on-media segment id is

bounded against, yet it is never checked against the device. Because

cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for

a segment id past the device resolves to ordinary kernel memory beyond

the mapping; a new-cache init reaching such an id has cache_seg_init() ->

cache_dev_zero_range() memset() 12 KiB over that memory -- an

out-of-bounds write into the kernel heap at table load. A zero seg_num

makes the segment allocations ZERO_SIZE_PTR.

Reject a seg_num that is zero, larger than the device can hold, or larger

than PCACHE_CACHE_SEGS_MAX before it is used.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References