CVE-2026-80961

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate kset key_num and intra-segment bounds

Two more fields decoded from the cache device go unbounded. The kset

key_num drives cache_kset_crc() and the replay loop in cache_replay(),

the writeback worker and the GC worker, but only the magic and a

fixed-seed CRC are checked first, so a non-last kset whose key_num exceeds

the PCACHE_KSET_KEYS_MAX buffer reads past its end before the CRC compare.

A key's intra-segment offset and length in cache_key_decode() are taken

verbatim, so a key running past its segment is replayed into the cache

tree and the data CRC check and every later read hit then copy adjacent

persistent memory into the caller's bio -- an out-of-bounds read that

leaks to user space. Both fields are controlled by whoever supplies the

cache device (CAP_SYS_ADMIN); the CRC seed is public.

Add kset_onmedia_valid() to bound key_num before any kset read, and

reject a key whose offset plus length

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References