CVE-2026-80959: Linux Kernel dm-pcache Privilege Escalation

CVE-2026-80959 Overview

CVE-2026-80959 is a Linux kernel vulnerability in the dm-pcache device-mapper target. The cache_pos_decode() function trusts the persisted key_tail and dirty_tailseg_off values read from the cache device without validating them against the segment data_size. An attacker with CAP_SYS_ADMIN who supplies a crafted cache device can set seg_off at or past the segment data boundary. The kernel then addresses memory past the segment data, producing an out-of-bounds read. The fix rejects any decoded seg_off that is not below the segment data_size.

Critical Impact
A local privileged user supplying a malicious cache device can trigger kernel out-of-bounds memory access, leading to information disclosure, memory corruption, or denial of service.

Affected Products

Linux kernel builds shipping the dm-pcache device-mapper target prior to the fix commits
Stable kernel branches referenced by commits 8bf7a06, d189857, and ffd9a21
Distributions repackaging affected upstream kernels

Discovery Timeline

2026-09-11 - CVE-2026-80959 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80959

Vulnerability Analysis

The dm-pcache target implements a persistent cache backed by a dedicated cache device. On initialization, the kernel reads persisted metadata that includes key_tail and dirty_tail, each carrying a segment identifier and an intra-segment offset (seg_off). The cache_pos_decode() helper converts these persisted positions into in-memory addresses used for subsequent reads.

The helper does not verify that the decoded seg_off falls within the usable segment range. When the persisted seg_off equals or exceeds the segment data_size, address computation resolves to memory outside the segment data region. Any subsequent read using that address returns kernel memory the caller was not intended to touch.

Because supplying the cache device requires CAP_SYS_ADMIN, exploitation is scoped to local privileged contexts. However, environments that delegate device-mapper administration or allow user-namespaced privileged operations broaden the exposure. The patched code rejects a decoded seg_off that is not below data_size, aborting the load before any out-of-bounds access occurs [CWE-125].

Root Cause

The root cause is missing input validation on persisted, attacker-controllable on-disk metadata. cache_pos_decode() trusts values from the cache device without bounds-checking seg_off against the segment's declared data_size.

Attack Vector

An attacker with CAP_SYS_ADMIN crafts a dm-pcache cache device whose persisted key_tail or dirty_tail carries a seg_off at or past data_size. Attaching that device causes the kernel to decode the position and access memory outside the segment data, producing an out-of-bounds read that can leak kernel data, corrupt state, or crash the system.

No verified public exploit is available. See the upstream commits 8bf7a06, d189857, and ffd9a21 for technical details.

Detection Methods for CVE-2026-80959

Indicators of Compromise

Kernel oops or panic traces referencing cache_pos_decode, dm-pcache, or associated segment access paths.
Unexpected dmsetup create or device-mapper table load events targeting pcache targets from non-standard users or automation.
Attachment of unfamiliar block devices as dm-pcache cache backends immediately preceding kernel faults.

Detection Strategies

Alert on device-mapper target creation events where the target type is pcache, especially outside change windows.
Correlate CAP_SYS_ADMIN operations with subsequent kernel warnings or slab-out-of-bounds reports in dmesg.
Baseline running kernel versions across the fleet and flag hosts still exposing the vulnerable dm-pcache code path.

Monitoring Recommendations

Forward /var/log/kern.log, journalctl -k, and KASAN reports to a central log platform for retention and correlation.
Monitor auditd rules covering mount, ioctl on /dev/mapper/control, and block device attachment.
Track kernel package installation and reboot state to confirm patched kernels are actually running.

How to Mitigate CVE-2026-80959

Immediate Actions Required

Inventory hosts running kernels that include the dm-pcache target and prioritize those handling untrusted block devices.
Apply vendor kernel updates that incorporate commits 8bf7a06, d189857, or ffd9a21 and reboot affected systems.
Restrict CAP_SYS_ADMIN and device-mapper administrative access to a minimal set of trusted operators.

Patch Information

The upstream fix adds a bounds check to cache_pos_decode() that rejects any decoded seg_off greater than or equal to the segment data_size. Merge the change from Kernel Git Commit 8bf7a06, Kernel Git Commit d189857, or Kernel Git Commit ffd9a21 and rebuild the kernel, or install the corresponding distribution update.

Workarounds

Do not load the dm-pcache module on systems that do not require persistent cache functionality.
Blacklist the module and prevent auto-load until a patched kernel is deployed.
Constrain who can create device-mapper targets by tightening sudo and PAM policies for privileged operations.

bash

# Disable dm-pcache until the kernel is patched
echo "blacklist dm-pcache" | sudo tee /etc/modprobe.d/blacklist-dm-pcache.conf
sudo rmmod dm_pcache 2>/dev/null
sudo update-initramfs -u