CVE-2026-80956: dm-pcache: only hand out initialized cache segments
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: only hand out initialized cache segments
getcachesegment() scans the segment map up to cache->nsegs, the physical device segment count, but cachesegsinit() only initializes the first cacheinfo->nsegs segments. A crafted image with cacheinfo->nsegs smaller than the device count leaves the remaining pcachecachesegment structs zeroed (segment.data == NULL), and the allocator can hand one to cacheksetclose(), which writes through the returned segment's data pointer with no NULL check.
Bound the allocator's search to cacheinfo->nsegs so only initialized segments are ever returned. A conforming cache sets nsegs equal to the device segment count, so this rejects nothing legitimate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The system must use dm-pcache with a crafted cache image whose cache_info->n_segs value is smaller than the physical device segment count. This leaves some segment structures uninitialized, allowing the allocator to return a segment with a NULL data pointer.
Are normally configured cache images affected?
A conforming cache image sets n_segs equal to the device segment count. The fix restricts allocation to initialized segments and does not reject legitimate conforming caches.
What is the likely consequence if a vulnerable system processes a crafted image?
cache_kset_close() can write through the uninitialized segment's NULL data pointer because it performs no NULL check. The provided data does not specify the resulting impact beyond that invalid write.