CVE-2026-80957: Linux Kernel dm-pcache DoS Vulnerability

CVE-2026-80957 Overview

CVE-2026-80957 is a Linux kernel vulnerability in the dm-pcache device-mapper target. The cache_replay() function walks the on-media last-kset chain via next_cache_seg_id without calling cond_resched(). A forged chain that loops back to a previously visited segment causes the replay routine to iterate indefinitely. The upstream fix caps last-kset hops at cache->n_segs, since a valid chain visits each segment at most once. The issue affects Linux kernel builds shipping the dm-pcache target.

Critical Impact
A maliciously crafted or corrupted persistent cache image can trigger an infinite loop during replay, resulting in kernel-side denial of service.

Affected Products

Linux kernel with the dm-pcache device-mapper target enabled
Distributions shipping vulnerable kernel builds prior to the referenced stable commits
Systems mounting or attaching untrusted persistent cache media

Discovery Timeline

2026-09-11 - CVE-2026-80957 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80957

Vulnerability Analysis

The dm-pcache target implements a persistent cache layer for the Linux device-mapper subsystem. During initialization, cache_replay() reconstructs cache state by traversing an on-media chain of last-kset records. Each record points to the next cache segment through next_cache_seg_id.

The original implementation trusted the chain terminator and contained no upper bound on iterations. It also omitted cond_resched(), preventing the scheduler from preempting the loop. When the chain forms a cycle, the replay routine follows it endlessly, consuming CPU and blocking device setup.

Root Cause

The root cause is missing input validation on persisted metadata. The replay loop treats on-disk pointers as trusted structural data. It performs no cycle detection and no hop counting. Any chain in which a next_cache_seg_id references a previously visited segment produces unbounded iteration.

Attack Vector

Exploitation requires supplying a crafted dm-pcache metadata image to a target system. An attacker with the ability to present persistent cache media, such as a malicious block device, tampered storage image, or a corrupted underlying volume, can trigger the loop when the target is activated. The impact is a denial of service on the kernel thread performing replay.

See the upstream commits for the full patch and replay-path context: Kernel Git Commit Fix, Kernel Git Commit Changes, and Kernel Git Commit Updates.

Detection Methods for CVE-2026-80957

Indicators of Compromise

Kernel worker threads pinned at 100% CPU during dm-pcache device activation or resume.
Soft lockup or RCU stall warnings referencing cache_replay in dmesg.
dmsetup create or dmsetup resume operations that never complete against a pcache target.

Detection Strategies

Monitor kernel log output for stall messages and stack traces containing cache_replay or dm-pcache frames.
Track long-running dmsetup and udev processes waiting on dm-pcache device readiness.
Alert when persistent cache devices are attached from removable or unverified sources.

Monitoring Recommendations

Ingest /var/log/messages, journalctl -k, and syslog into a centralized logging platform and search for soft lockup events correlated with device-mapper activity.
Baseline kernel CPU utilization on hosts using dm-pcache and alert on sustained high system time.
Audit block device attachment events on servers that expose device-mapper functionality to non-root workflows.

How to Mitigate CVE-2026-80957

Immediate Actions Required

Inventory hosts with the dm-pcache module loaded using lsmod | grep pcache and prioritize patched kernels.
Restrict activation of dm-pcache targets to trusted metadata images and administrators.
Avoid attaching untrusted or externally supplied persistent cache media to production systems.

Patch Information

Apply the upstream fix that caps the last-kset traversal at cache->n_segs, ensuring the replay loop terminates on any cyclic chain. The change is available in the stable tree via Kernel Git Commit Fix, Kernel Git Commit Changes, and Kernel Git Commit Updates. Rebuild or update to a distribution kernel that incorporates these commits.

Workarounds

Blacklist the dm-pcache kernel module on systems that do not require persistent cache functionality.
Enforce administrative controls so only vetted metadata images are used with dmsetup targets of type pcache.
Where feasible, isolate workloads that must use dm-pcache on dedicated hosts to contain denial-of-service impact.

bash

# Configuration example: prevent loading of the dm-pcache module
echo 'blacklist dm-pcache' | sudo tee /etc/modprobe.d/blacklist-dm-pcache.conf
sudo depmod -a
# Verify the module is not currently loaded
lsmod | grep pcache || echo "dm-pcache not loaded"