CVE-2026-80962: dm-pcache: validate geometry fields from on-disk cache_info
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate geometry fields from on-disk cacheinfo
cachesegsinit() iterates cacheinfo->nsegs times indexing cache->segments[], which is sized to the cache device geometry, and getsegid() takes each segment id from the on-media cacheinfo and the per-segment nextseg link. Both come from cache device metadata that is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAPSYSADMIN) controls them: an oversized nsegs or an out-of-range id drives an out-of-bounds access of cache->segments[] and a wild CACHEDEVSEGMENT() pointer into the device mapping -- an out-of-bounds read and write from on-disk data.
Reject an nsegs that exceeds the device segment count and a segment id that is out of range before either is used. Valid metadata is unaffected.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to supply the cache device during a device-mapper table load, which requires CAP_SYS_ADMIN.
Can the cache metadata CRC be relied on to prevent malicious inputs?
No. The metadata is CRC-protected with a fixed public seed, so it does not prevent a party supplying the cache device from controlling the relevant geometry and segment-link fields.
What metadata values indicate a malicious or unsafe cache device?
Unsafe values include an n_segs value greater than the cache device's segment count, or any segment ID, including a next_seg link, that is outside the valid segment range.
What can be done before the fix is deployed?
Restrict CAP_SYS_ADMIN access and avoid loading dm-pcache tables using cache devices from untrusted sources. Valid cache metadata is unaffected by the added validation.