CVE-2026-80956: dm-pcache: only hand out initialized cache segments
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: only hand out initialized cache segments
getcachesegment() scans the segment map up to cache->nsegs, the physical device segment count, but cachesegsinit() only initializes the first cacheinfo->nsegs segments. A crafted image with cacheinfo->nsegs smaller than the device count leaves the remaining pcachecachesegment structs zeroed (segment.data == NULL), and the allocator can hand one to cacheksetclose(), which writes through the returned segment's data pointer with no NULL check.
Bound the allocator's search to cacheinfo->nsegs so only initialized segments are ever returned. A conforming cache sets nsegs equal to the device segment count, so this rejects nothing legitimate.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The system must use dm-pcache with a crafted cache image whose cache_info->n_segs value is smaller than the physical device segment count. This leaves some segment structures uninitialized, allowing the allocator to return a segment with a NULL data pointer.
Are normally configured cache images affected?
A conforming cache image sets n_segs equal to the device segment count. The fix restricts allocation to initialized segments and does not reject legitimate conforming caches.
What is the likely consequence if a vulnerable system processes a crafted image?
cache_kset_close() can write through the uninitialized segment's NULL data pointer because it performs no NULL check. The provided data does not specify the resulting impact beyond that invalid write.