CVE-2026-80962

The Linux kernel's dm-pcache device-mapper target fails to validate geometry fields (n_segs and per-segment ids) read from the on-disk cache_info metadata before using them to index cache->segments[], so an oversized n_segs or out-of-range segment id drives an out-of-bounds read and write plus a wild pointer via CACHE_DEV_SEGMENT(). The values come from cache-device metadata that is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a device-mapper table load fully controls them; the table load itself requires CAP_SYS_ADMIN, making this a local, low-privilege-required attack (CVSS 7.8). A successful attacker gains kernel memory corruption with high impact on confidentiality, integrity, and availability — plausibly a kernel crash or a sandbox/privilege boundary escape from an already-privileged position — and even unintentionally corrupted cache metadata could trigger the out-of-bounds access. Affected systems are Linux kernels shipping the dm-pcache target where untrusted or corrupted cache devices can be loaded. No public proof of concept is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Update to a kernel containing the upstream fix, which rejects an n_segs exceeding the device segment count and out-of-range segment ids before use. Until patched, restrict who can obtain CAP_SYS_ADMIN and load device-mapper tables (e.g., lock down /dev/mapper/control and avoid granting CAP_SYS_ADMIN to containers or untrusted local users). If you use dm-pcache, verify the integrity of cache-device metadata before loading it, since corrupted media can trigger the same out-of-bounds access even without malice.