CVE-2026-80958: dm-pcache: clamp the tail kset read to the segment data region
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: clamp the tail kset read to the segment data region
The tail-kset read in cachereplay(), the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area.
Clamp the read to cachesegremain(), the data region.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the dm-pcache fix: in cache_replay(), the writeback worker, and the GC, clamp the tail kset read so it does not read past the segment data into the control area; bound the read length by PCACHE_SEG_SIZE - seg_off (tail-kset read length).
Linux kernel (dm-pcache) Clamp tail kset read in cache_replay(), writeback worker, and GC to the segment data region = PCACHE_SEG_SIZE - seg_off (bounds tail kset read length)
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel dm-pcache component are exposed when cache replay, the writeback worker, or the garbage-collection worker processes a tail kset near the end of a cache segment.
What condition triggers the out-of-bounds read?
The issue occurs when a tail kset is near the end of a segment. The affected code calculates the readable length against the raw segment size instead of the segment data region, allowing the read to extend into the following control area.
How can I determine whether the fix is present?
Check whether the kernel source or applied stable patches changes the tail-kset read bounds in cache_replay(), the writeback worker, and the GC worker to use cache_seg_remain() rather than PCACHE_SEG_SIZE - seg_off. The provided stable references identify commits containing the fix.