UBUNTU-CVE-2026-93201: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode(), cachekeydecode() and the last-kset branches of cachereplay(), the writeback worker and the GC worker take a cache segment id from the cache device metadata and index cache->segments[] with it without checking it against cache->nsegs. That metadata is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAPSYSADMIN) controls the id; an out-of-range value forms a wild pcachecachesegment pointer that is dereferenced and written through -- an out-of-bounds read and write driven by on-disk data. Add cachesegidvalid() and reject an out-of-range id at each decode site, failing the operation with -EIO instead of indexing past the array. Bound the id against the initialized-segment count (cacheinfo.nsegs) rather than the physical device total. A forged cacheinfo.nsegs below segnum otherwise leaves segments[cacheinfo.nsegs..segnum) as zeroed structs whose data pointer is NULL, so a forged id in that window would still be dereferenced. A later patch guarantees cacheinfo.nsegs <= segnum, and a driver-created cache sets the two equal, so valid images are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add cache_seg_id_valid() and invoke it at every cache segment ID decode/indexing site, including cache_pos_decode(), cache_key_decode(), the last-kset branches of cache_replay(), the writeback worker, and the GC worker. Reject IDs outside the initialized segment range [0, cache_info.n_segs) and fail the operation with -EIO; validate against cache_info.n_segs rather than the physical device total.