CVE-2026-93201: dm-pcache: validate seg_id fields from persistent memory
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate segid fields from persistent memory
cacheposdecode(), cachekeydecode() and the last-kset branches of cachereplay(), the writeback worker and the GC worker take a cache segment id from the cache device metadata and index cache->segments[] with it without checking it against cache->nsegs. That metadata is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAPSYSADMIN) controls the id; an out-of-range value forms a wild pcachecachesegment pointer that is dereferenced and written through -- an out-of-bounds read and write driven by on-disk data.
Add cachesegidvalid() and reject an out-of-range id at each decode site, failing the operation with -EIO instead of indexing past the array. Bound the id against the initialized-segment count (cacheinfo.nsegs) rather than the physical device total. A forged cacheinfo.nsegs below segnum otherwise leaves segments[cacheinfo.nsegs..segnum) as zeroed structs whose data pointer is NULL, so a forged id in that window would still be dereferenced. A later patch guarantees cacheinfo.nsegs <= segnum, and a driver-created cache sets the two equal, so valid images are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In dm-pcache, add cache_seg_id_valid() checks at each cache segment ID decode/indexing site, including cache_pos_decode(), cache_key_decode(), cache_replay() last-kset branches, the writeback worker, and the GC worker. Validate IDs against the initialized-segment count cache_info.n_segs rather than the physical device total, and fail the operation with -EIO when the ID is out of range.
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs CAP_SYS_ADMIN and the ability to supply the cache device when loading a device-mapper table. They can control the persistent-memory cache metadata containing the segment ID.
Does the metadata CRC prevent malicious segment IDs?
No. The metadata is CRC-protected with a fixed public seed, so a party supplying the cache device can forge metadata with an out-of-range segment ID.
What is the impact of a forged segment ID?
An out-of-range ID can be used to index past cache->segments[], producing a wild segment pointer. The kernel can then perform out-of-bounds reads and writes driven by on-disk metadata.
How does the resolved behavior handle invalid metadata?
The resolved code validates IDs against the initialized segment count, cache_info.n_segs, before indexing the segment array. Invalid IDs cause the affected operation to fail with -EIO.