CVE-2026-80959: dm-pcache: bound the persisted tail-position offset
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: bound the persisted tail-position offset
cacheposdecode() takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize, controllable by whoever supplies the device (CAPSYSADMIN), reads past the segment data.
Reject a decoded segoff that is not below the segment datasize.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker must be able to supply the cache device and have CAP_SYS_ADMIN privileges. This makes the issue primarily relevant where an administrator-level actor can control persisted dm-pcache metadata.
What malformed data is required for exploitation?
The persisted key_tail or dirty_tail segment offset must be at or beyond the segment's data_size. When decoded, that offset can cause an access past the segment data.
What can be done if the fix cannot be deployed immediately?
Restrict CAP_SYS_ADMIN access and do not use cache devices whose persisted metadata is untrusted or controlled by untrusted parties.