CVE-2026-80955: dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: fix use-after-free and invalid seg operations in ksetreplay()
In ksetreplay, when key->seggen is stale (key->seggen < key->cachepos.cacheseg->gen), cachekeyput(key) is called but then key->cachepos.cacheseg is accessed as the argument to cachesegget(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug.
Additionally, for expired invalid keys, setting the cache->segmap bit and calling cachesegget() is unreasonable since the corresponding segment data is no longer valid.
Fix both issues by moving cachesegget() and setbit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected component is dm-pcache in the Linux kernel. Exposure therefore depends on whether dm-pcache is present and in use; the provided information does not identify affected kernel versions or configurations.
What condition triggers the vulnerable path?
The issue occurs in kset_replay() when a key has a stale segment generation, meaning key->seg_gen is less than key->cache_pos.cache_seg->gen. Expired invalid keys can also reach inappropriate segment-map and segment-reference operations before the fix.
How can administrators determine whether the fix is present?
Check the kernel source or applied stable patches for the referenced changes. The fix moves cache_seg_get() and __set_bit() until after the generation check and skips invalid keys with continue.