CVE-2026-80955

The Linux kernel's dm-pcache device-mapper target contains a use-after-free in kset_replay(): when a replayed key's seg_gen is stale relative to the cache segment's generation, cache_key_put(key) drops the key, but key->cache_pos.cache_seg is then read as the argument to cache_seg_get(), dereferencing freed key memory. A second defect in the same path performs unreasonable operations on expired invalid keys — setting the cache->seg_map bit and taking a segment reference via cache_seg_get() even though that segment's data is no longer valid. The flaw is triggered during kset replay on a dm-pcache device carrying stale-generation keys, which an attacker able to reach or manipulate the replayed metadata (a local, low-privilege context per CVSS AV:L/PR:L, or stale/corrupt on-disk state) could influence. Successful exploitation could yield kernel memory corruption with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8), i.e., potential local privilege escalation or kernel crash; although mempool recycling means the freed memory is not immediately reclaimed in practice, the UAF remains exploitable in principle. No public proof of concept exists, the CVE is not in CISA's KEV catalog, and no exploitation is known; the fix moves cache_seg_get() and __set_bit() after the generation check so they only execute for valid keys, and skips invalid keys with continue.

What to do: Patch to a kernel release or stable backport containing the dm-pcache kset_replay() fix (moves cache_seg_get()/__set_bit() after the gen check and skips invalid keys) and track your distro's kernel advisories for its CVE assignment. Systems not using the dm-pcache device-mapper target are not exposed, so audit dmsetup tables and storage configs to confirm whether any dm-pcache devices exist. Until patched, avoid replaying older/stale kset metadata on dm-pcache devices and restrict local untrusted user access on hosts that use the target.