CVE-2026-80955: Linux Kernel dm-pcache Use-After-Free

CVE-2026-80955 Overview

CVE-2026-80955 is a use-after-free vulnerability in the Linux kernel's dm-pcache device-mapper target. The flaw resides in the kset_replay() function, where a stale key->seg_gen value triggers cache_key_put(key) followed by continued access to key->cache_pos.cache_seg. This dereference occurs on memory that has already been returned to the mempool. The issue also causes invalid segment map operations for expired keys, corrupting cache state during replay.

Critical Impact
A local, authenticated attacker with access to a system using dm-pcache can trigger memory corruption in kernel space, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the dm-pcache device-mapper target prior to the fix commits
Distributions shipping vulnerable stable kernel branches referenced by commits 1894fc7a, c2e894ea, and f39a3e9c
Systems using persistent cache device-mapper targets built on dm-pcache

Discovery Timeline

2026-09-11 - CVE-2026-80955 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80955

Vulnerability Analysis

The vulnerability affects the kset_replay() routine in the dm-pcache module, which replays cached key sets during device-mapper initialization or recovery. During replay, each key is validated by comparing key->seg_gen against the current generation counter of the referenced cache segment (key->cache_pos.cache_seg->gen).

When key->seg_gen is stale, meaning it is less than the segment's current generation, the code calls cache_key_put(key) to release the key back to its mempool. The original code then continues to access key->cache_pos.cache_seg when invoking cache_seg_get(). This constitutes a classic use-after-free [CWE-416] on kernel memory.

Additionally, for expired invalid keys the code sets a bit in cache->seg_map and increments the segment reference through cache_seg_get(). Both operations are semantically incorrect because the underlying segment data is no longer valid, corrupting the cache metadata state.

Root Cause

The root cause is an ordering defect: the release of the key object precedes the final access to fields owned by that object. Although mempool-recycled memory is not immediately overwritten in practice, the pointer is logically freed and any subsequent dereference is undefined behavior. The fix reorders operations so that cache_seg_get() and __set_bit() execute only for valid keys, and invalid keys are skipped with a continue statement.

Attack Vector

Exploitation requires local access with privileges sufficient to create or interact with a dm-pcache device-mapper target. An attacker capable of crafting cache metadata or triggering replay with stale generation values can invoke the vulnerable code path. Successful exploitation may corrupt kernel memory, allowing privilege escalation or causing a kernel panic.

No public proof-of-concept exploit is available at the time of publication. Refer to the upstream fixes in Linux Kernel Commit 1894fc7a, Linux Kernel Commit c2e894ea, and Linux Kernel Commit f39a3e9c for the code-level remediation.

Detection Methods for CVE-2026-80955

Indicators of Compromise

Unexpected kernel oops or panic messages referencing kset_replay, cache_key_put, or cache_seg_get in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the dm-pcache module
Corrupted or inconsistent dm-pcache device state following cache replay operations

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access patterns in dm-pcache code paths
Audit loaded kernel modules with lsmod | grep pcache to identify systems exposing the vulnerable target
Correlate kernel crash telemetry with device-mapper activity to identify replay-triggered failures

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on stack traces containing dm-pcache symbols
Track kernel version inventory across Linux hosts to identify unpatched systems
Monitor privileged local activity that creates or manipulates device-mapper targets, particularly in multi-tenant environments

How to Mitigate CVE-2026-80955

Immediate Actions Required

Apply the upstream kernel fixes referenced by commits 1894fc7a, c2e894ea, and f39a3e9c as soon as vendor packages are available
Update to a stable Linux kernel release that includes the kset_replay() ordering fix
Restrict local access and device-mapper administration privileges to trusted users only

Patch Information

The fix moves cache_seg_get() and __set_bit() operations after the generation-check comparison, ensuring they execute only for valid keys. Invalid keys are skipped with continue, eliminating both the use-after-free and the invalid segment map manipulation. Consult your Linux distribution's security tracker for backported kernel packages.

Workarounds

Unload the dm-pcache module with modprobe -r dm-pcache on systems that do not require persistent cache functionality
Blacklist the dm-pcache module in /etc/modprobe.d/ to prevent automatic loading until patched
Limit CAP_SYS_ADMIN and device-mapper access to minimize the set of users capable of triggering the vulnerable path

bash

# Prevent dm-pcache from loading until the kernel is patched
echo "blacklist dm-pcache" | sudo tee /etc/modprobe.d/blacklist-dm-pcache.conf
sudo modprobe -r dm-pcache 2>/dev/null || true
sudo update-initramfs -u