CVE-2026-93198: dm-pcache: validate the persisted dirty_tail chain at load
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate the persisted dirtytail chain at load
The writeback worker follows the persisted dirtytail chain, which is decoded from the cache device independently of the keytail chain that cachereplay() walks and bounds. A crafted image, whose on-media fields are authenticated only by a crc32c with a fixed seed, can aim dirtytail at a chain of last ksets that never terminates, so cachewritebackfn() re-arms itself with no delay forever.
Walk the dirtytail chain once at load with the same hop cap cachereplay() uses and fail the table load with -EIO if it does not reach an end within nsegs hops.