CVE-2026-80958

The Linux kernel's dm-pcache device-mapper persistent cache target performs an out-of-bounds read when it processes the tail kset in cache_replay(), the writeback worker, and the garbage-collection worker: the read length is bounded by the raw segment size (PCACHE_SEG_SIZE - seg_off) rather than the segment's data region, so a tail near the end of a segment reads past the data into the adjacent control area. The flaw is triggered during ordinary cache operation — crash replay, writeback, or garbage collection on a pcache device whose tail kset sits close to a segment boundary. A local attacker with low privileges on an affected host could use this to disclose adjacent metadata/control-area contents from kernel memory (high confidentiality impact) and potentially to crash or hang the kernel, causing denial of service (high availability impact); integrity is not affected. Only systems running a kernel that includes the dm-pcache target and that actually use it for a cache device are exposed. No public proof of concept exists and the vulnerability is not known to be exploited in the wild.

What to do: Apply a kernel update containing the dm-pcache fix as soon as your distribution ships it. Until then, avoid creating new dm-pcache cached volumes (or remap existing ones to plain devices) where feasible, and monitor dmesg for dm-pcache errors or crashes during replay, writeback, or GC. Because exploitation requires local low-privilege access, maintain standard local hardening: restrict untrusted local accounts and limit container/sandbox exposure on hosts running pcache devices.