CVE-2026-80958: dm-pcache: clamp the tail kset read to the segment data region
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: clamp the tail kset read to the segment data region
The tail-kset read in cachereplay(), the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area.
Clamp the read to cachesegremain(), the data region.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In dm-pcache, clamp the tail-kset read in cache_replay(), the writeback worker, and the GC worker to cache_seg_remain(), limiting reads to the segment data region rather than PCACHE_SEG_SIZE - seg_off.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel dm-pcache component are exposed when cache replay, the writeback worker, or the garbage-collection worker processes a tail kset near the end of a cache segment.
What condition triggers the out-of-bounds read?
The issue occurs when a tail kset is near the end of a segment. The affected code calculates the readable length against the raw segment size instead of the segment data region, allowing the read to extend into the following control area.
How can I determine whether the fix is present?
Check whether the kernel source or applied stable patches changes the tail-kset read bounds in cache_replay(), the writeback worker, and the GC worker to use cache_seg_remain() rather than PCACHE_SEG_SIZE - seg_off. The provided stable references identify commits containing the fix.