CVE-2026-80958: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80958 Overview

CVE-2026-80958 is an out-of-bounds read vulnerability in the Linux kernel dm-pcache device-mapper target. The flaw resides in the tail-kset read path used by cache_replay(), the writeback worker, and the garbage collection (GC) worker. These paths incorrectly bound the read length by PCACHE_SEG_SIZE - seg_off, which represents the raw segment size rather than the smaller data region. When a tail sits close to the segment boundary, the read extends past the segment data area into the adjacent control region. The fix clamps the read to cache_seg_remain(), which returns the true data region size.

Critical Impact
A local authenticated user with access to a dm-pcache device can trigger reads into adjacent segment control metadata, leading to memory corruption effects and potential denial of service of the storage stack.

Affected Products

Linux kernel versions containing the dm-pcache target prior to the fixing commits
Distributions shipping the affected mainline dm-pcache code
Systems using device-mapper persistent cache (dm-pcache) with segment-based storage

Discovery Timeline

2026-09-11 - CVE-2026-80958 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in the NVD database

Technical Details for CVE-2026-80958

Vulnerability Analysis

The Linux kernel dm-pcache target divides each cache segment into a data region followed by a control area holding segment metadata. Read paths that consume the tail k-set (key set) must therefore stop at the data region boundary. The affected code instead calculates the maximum read length using PCACHE_SEG_SIZE - seg_off, which is the full raw segment size. When seg_off approaches the end of the data region, the resulting length permits the read to cross into the following control area. This produces an out-of-bounds read that mixes control metadata into structures interpreted as k-set data. The condition is reachable through three separate code paths: cache replay during device activation, the writeback worker draining dirty entries, and the GC worker reclaiming segments.

Root Cause

The root cause is an incorrect upper bound in a length calculation. The code used the raw segment size constant PCACHE_SEG_SIZE as the clamping value rather than the effective data region length returned by cache_seg_remain(). The mismatch allows the tail read to span the boundary separating data from control metadata inside the same segment.

Attack Vector

Exploitation requires local access with permissions to interact with a dm-pcache device or to influence cache activation, writeback, or GC operations. A crafted cache layout with a tail k-set positioned near the segment end triggers the out-of-bounds read on any of the three affected paths. The vulnerability affects confidentiality and availability of the storage subsystem but does not directly compromise integrity per the CVSS vector.

The vulnerability manifests in the dm-pcache tail k-set read path. See the upstream kernel commits for the exact code changes and boundary logic.

Detection Methods for CVE-2026-80958

Indicators of Compromise

Kernel log entries referencing dm-pcache errors during device activation, replay, writeback, or garbage collection
KASAN or slab corruption reports naming dm-pcache functions such as cache_replay or the writeback and GC worker threads
Unexpected I/O errors or device-mapper target failures on cache devices backed by dm-pcache

Detection Strategies

Inventory hosts running kernels that include the vulnerable dm-pcache code and enumerate active dm-pcache targets using dmsetup table
Enable CONFIG_KASAN on non-production kernels to surface out-of-bounds reads in the tail k-set path during replay or worker execution
Correlate dmesg output with device-mapper events to identify segments where reads approach the data region boundary

Monitoring Recommendations

Forward kernel logs from storage nodes to a centralized log platform and alert on dm-pcache errors or KASAN reports
Track kernel package versions across the fleet to confirm coverage of the three fixing commits
Monitor for unexpected reboots or storage stack hangs on hosts using persistent cache targets

How to Mitigate CVE-2026-80958

Immediate Actions Required

Apply the upstream Linux kernel patches that clamp the tail k-set read to cache_seg_remain()
Restrict local access and device-mapper administrative privileges to trusted users on systems using dm-pcache
If patching is not immediately possible, unload or avoid activating dm-pcache targets on affected kernels

Patch Information

The fix replaces the PCACHE_SEG_SIZE - seg_off bound with cache_seg_remain() in the three affected code paths. Merged commits are available in the stable kernel tree: Kernel Commit 1ab55354, Kernel Commit 2cd9776f, and Kernel Commit becf07e2. Rebuild or upgrade to a kernel release that incorporates these commits and reboot affected hosts.

Workarounds

Avoid loading the dm-pcache module on hosts that do not require persistent cache functionality
Limit which users and services can issue dmsetup operations that create or activate dm-pcache targets
Where possible, migrate cached workloads to an alternate device-mapper target until patched kernels are deployed

bash

# Check running kernel version and dm-pcache usage
uname -r
lsmod | grep dm_pcache
dmsetup table | grep pcache

# Prevent the module from loading until patched
echo 'blacklist dm_pcache' | sudo tee /etc/modprobe.d/blacklist-dm-pcache.conf
sudo update-initramfs -u