CVE-2026-80956: Linux Kernel dm-pcache Use-After-Free Vulnerability

CVE-2026-80956 Overview

CVE-2026-80956 is a Linux kernel vulnerability in the dm-pcache device-mapper target. The flaw allows the segment allocator to return uninitialized cache segments to callers. When cache_kset_close() receives such a segment, it dereferences a null segment.data pointer, causing a kernel crash or potential memory corruption.

The issue occurs when a crafted cache image sets cache_info->n_segs smaller than the physical device segment count (cache->n_segs). The allocator scans up to the larger value, exposing zero-initialized pcache_cache_segment structs. The fix bounds the allocator search to cache_info->n_segs so only initialized segments are returned.

Critical Impact
A malicious or corrupted cache image can trigger a null pointer dereference in kernel context, leading to denial of service on hosts that mount attacker-supplied dm-pcache volumes.

Affected Products

Linux kernel versions containing the dm-pcache device-mapper target
Distributions shipping stable kernels prior to the fix commits
Storage stacks using persistent cache device-mapper targets

Discovery Timeline

2026-09-11 - CVE-2026-80956 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80956

Vulnerability Analysis

The dm-pcache target implements a persistent block cache on top of a physical cache device. During initialization, cache_segs_init() prepares only the first cache_info->n_segspcache_cache_segment structures, allocating their data buffers and internal state. Segments beyond that index remain zero-filled.

The allocator function get_cache_segment() searches the segment bitmap up to cache->n_segs, which reflects the underlying physical device capacity rather than the initialized subset. When these values diverge, the allocator can return a segment whose data pointer is NULL.

The caller cache_kset_close() writes through the returned segment's data pointer without checking for null. The write proceeds in kernel context, producing a null pointer dereference [CWE-476] and an oops or panic depending on kernel configuration.

Root Cause

The root cause is a mismatch between two segment counts that should have been treated as a single bound. cache->n_segs describes the physical device layout, while cache_info->n_segs is a metadata-controlled value that governs actual initialization. The allocator trusted the physical bound instead of the initialized bound, allowing zeroed structs to be reached through a legitimate code path.

Attack Vector

Exploitation requires the ability to present a crafted dm-pcache metadata image to a target host and cause the kernel to activate it. This typically requires local privilege to invoke device-mapper ioctls or the ability to attach removable or network-backed storage that a privileged process will mount. Once the malformed cache is loaded, normal I/O activity that triggers cache_kset_close() will dereference the null data pointer and crash the kernel.

The vulnerability is described in prose only; refer to the upstream fix commits for the exact patch diff and reproducer context.

Detection Methods for CVE-2026-80956

Indicators of Compromise

Kernel oops or panic messages referencing cache_kset_close, get_cache_segment, or dm-pcache in dmesg and /var/log/kern.log
Sudden host reboots or hangs correlated with activation of a new dm-pcache device via dmsetup
Unexpected pcache_cache_segment faults in crash dumps captured by kdump

Detection Strategies

Monitor kernel ring buffer output for null pointer dereference traces originating in device-mapper cache code paths
Audit device-mapper table load events for pcache targets that reference untrusted or externally supplied metadata
Compare running kernel versions against the fixed commits 2df0fc0, 692037a, and 83e3116 from the upstream stable tree

Monitoring Recommendations

Ingest auditd and syslog kernel facility events into a centralized data lake to correlate dmsetup activity with subsequent crash traces
Alert on privileged invocations of dmsetup create or ioctl(DM_TABLE_LOAD) targeting pcache on production hosts
Track kernel package versions across the fleet and flag hosts running unpatched builds of the dm-pcache module

How to Mitigate CVE-2026-80956

Immediate Actions Required

Apply the upstream stable kernel updates referenced by commits 2df0fc0, 692037a, and 83e3116
Restrict device-mapper administrative capabilities (CAP_SYS_ADMIN) to trusted service accounts on multi-tenant hosts
Reject or quarantine dm-pcache metadata originating from untrusted sources until patched kernels are deployed

Patch Information

The fix bounds get_cache_segment() to cache_info->n_segs so only initialized segments are returned. Conforming cache images set cache_info->n_segs equal to the physical device segment count, so no legitimate configuration is rejected. Distribution vendors will ship the fix through standard stable kernel updates; consult your vendor advisory for the corresponding package version.

Workarounds

Unload the dm-pcache module (modprobe -r dm-pcache) on systems that do not require persistent cache functionality
Blacklist the module in /etc/modprobe.d/ to prevent runtime autoload on hosts where the feature is unused
Disallow attachment of external block devices that may carry crafted device-mapper metadata

bash

# Disable dm-pcache autoload until the kernel is patched
echo 'blacklist dm-pcache' | sudo tee /etc/modprobe.d/disable-dm-pcache.conf
sudo modprobe -r dm-pcache 2>/dev/null || true
sudo update-initramfs -u