CVE-2026-93201: dm-pcache: validate seg_id fields from persistent memory
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate segid fields from persistent memory
cacheposdecode(), cachekeydecode() and the last-kset branches of cachereplay(), the writeback worker and the GC worker take a cache segment id from the cache device metadata and index cache->segments[] with it without checking it against cache->nsegs. That metadata is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAPSYSADMIN) controls the id; an out-of-range value forms a wild pcachecachesegment pointer that is dereferenced and written through -- an out-of-bounds read and write driven by on-disk data.
Add cachesegidvalid() and reject an out-of-range id at each decode site, failing the operation with -EIO instead of indexing past the array. Bound the id against the initialized-segment count (cacheinfo.nsegs) rather than the physical device total. A forged cacheinfo.nsegs below segnum otherwise leaves segments[cacheinfo.nsegs..segnum) as zeroed structs whose data pointer is NULL, so a forged id in that window would still be dereferenced. A later patch guarantees cacheinfo.nsegs <= segnum, and a driver-created cache sets the two equal, so valid images are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement dm-pcache changes to validate seg_id fields from persistent memory. Bound the decoded id against cache_info.n_segs (initialized-segment count) and reject out-of-range ids using cache_seg_id_valid() at each decode, so invalid images fail the operation with -EIO instead of indexing past cache->segments[].
dm-pcache seg_id validation = Add cache_seg_id_valid() and reject an out-of-range id at each decode; validate seg_id fields from persistent memory against cache_info.n_segs (initialized-segment count) rather than the physical device total; fail with -EIO on invalid id - Compensating control
If applicable to your deployment, ensure CAP_SYS_ADMIN (cache device table load permissions) is restricted, since id validation is related to how dm-pcache cache devices are created/loaded.
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs CAP_SYS_ADMIN and the ability to supply the cache device when loading a device-mapper table. They can control the persistent-memory cache metadata containing the segment ID.
Does the metadata CRC prevent malicious segment IDs?
No. The metadata is CRC-protected with a fixed public seed, so a party supplying the cache device can forge metadata with an out-of-range segment ID.
What is the impact of a forged segment ID?
An out-of-range ID can be used to index past cache->segments[], producing a wild segment pointer. The kernel can then perform out-of-bounds reads and writes driven by on-disk metadata.
How does the resolved behavior handle invalid metadata?
The resolved code validates IDs against the initialized segment count, cache_info.n_segs, before indexing the segment array. Invalid IDs cause the affected operation to fail with -EIO.