UBUNTU-CVE-2026-80960: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAPSYSADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cachedev->mapping is the direct map of the pmem, CACHEDEVSEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cacheseginit() -> cachedevzerorange() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero segnum makes the segment allocations ZEROSIZEPTR. Reject a segnum that is zero, larger than the device can hold, or larger than PCACHECACHESEGSMAX before it is used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Before using the on-media seg_num, reject cache devices when seg_num is zero, exceeds the number of segments the device can hold, or exceeds PCACHE_CACHE_SEGS_MAX.
Event History
Frequently Asked Questions
Who can trigger the out-of-bounds write?
An attacker needs CAP_SYS_ADMIN and the ability to supply the cache device when loading a device-mapper table. The attacker controls seg_num through the cache device's CRC32C-only on-media superblock.
What malformed values are relevant for triage?
The vulnerable path involves a seg_num of zero, a value larger than the cache device can hold, or a value larger than PCACHE_CACHE_SEGS_MAX. Such values must be rejected before segment allocations or on-media segment access occur.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.