UBUNTU-CVE-2026-80961: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc() and the replay loop in cachereplay(), the writeback worker and the GC worker, but only the magic and a fixed-seed CRC are checked first, so a non-last kset whose keynum exceeds the PCACHEKSETKEYSMAX buffer reads past its end before the CRC compare. A key's intra-segment offset and length in cachekeydecode() are taken verbatim, so a key running past its segment is replayed into the cache tree and the data CRC check and every later read hit then copy adjacent persistent memory into the caller's bio -- an out-of-bounds read that leaks to user space. Both fields are controlled by whoever supplies the cache device (CAPSYSADMIN); the CRC seed is public. Add ksetonmediavalid() to bound keynum before any kset read, and reject a key whose offset plus length, computed in 64 bits, exceeds the segment datasize. Valid metadata is unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In dm-pcache, add kset_onmedia_valid() to validate key_num before any kset read, reject non-last ksets whose key_num exceeds PCACHE_KSET_KEYS_MAX, and reject keys whose intra-segment offset plus length—computed in 64 bits—exceeds the segment data_size.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs CAP_SYS_ADMIN and control over the cache device supplying dm-pcache metadata. The vulnerable fields are controlled by the cache-device provider, so this is primarily relevant where a privileged user or management component can attach or manipulate a malicious cache device.
What could successful exploitation expose or affect?
A malformed key can extend beyond its segment and cause later cache reads to copy adjacent persistent memory into the caller's bio, leaking data to user space. An oversized kset key_num can also cause out-of-bounds reads during metadata validation, replay, writeback, or garbage collection.
Are valid existing dm-pcache metadata layouts affected by the fix?
No. The fix adds bounds checks for kset key counts and key offset-plus-length values, and the provided information states that valid metadata is unaffected.
How can I determine whether my environment is exposed?
Review whether dm-pcache is in use and whether any CAP_SYS_ADMIN principal or privileged automation can provide or alter its cache device. Exposure depends on processing attacker-controlled cache-device metadata; the supplied information does not identify a detectable on-disk indicator beyond malformed bounds values.