CVE-2026-80959

The Linux kernel's dm-pcache (device-mapper persistent cache) target fails to validate the persisted key_tail and dirty_tail segment offsets it decodes from a cache device. cache_pos_decode() uses these attacker-influenced values to address within a segment, so a seg_off at or beyond the segment's data_size causes the kernel to read past the end of the segment data. Exploitation requires an attacker who can supply a crafted cache device and already holds CAP_SYS_ADMIN (the privilege needed to load a dm table), meaning this is primarily a privilege-boundary and memory-safety issue within privileged system configuration rather than a remotely exploitable flaw. Successful abuse could yield disclosure or corruption of adjacent kernel memory (CVSS 7.8, local vector, C:H/I:H/A:H). No public proof of concept is known and the flaw is not listed in CISA's KEV catalog.

What to do: Apply kernel updates once your distro ships the fix that rejects seg_off values at or past the segment data_size, and treat any cache-device image from untrusted provenance as untrusted kernel input. Verify whether you are exposed at all by checking for the dm-pcache target (kernel config/module presence and any active dm tables using it) — most deployments do not use it. As defense in depth, restrict CAP_SYS_ADMIN and control over block devices/cache images to trusted administrators only.