CVE-2026-80960: Linux Kernel dm-pcache Privilege Escalation

CVE-2026-80960 Overview

CVE-2026-80960 is a Linux kernel vulnerability in the dm-pcache device-mapper target. The flaw stems from missing validation of the seg_num field read from the on-media superblock of a cache device. A local user with CAP_SYS_ADMIN who supplies a crafted cache device during a device-mapper table load can trigger an out-of-bounds write into the kernel heap. When seg_num exceeds the actual device size, CACHE_DEV_SEGMENT() resolves to kernel memory beyond the persistent memory (pmem) mapping, and cache_seg_init() calls cache_dev_zero_range() to memset() 12 KiB across that memory. A zero seg_num also produces ZERO_SIZE_PTR segment allocations.

Critical Impact
A privileged local actor can corrupt kernel heap memory during table load, enabling denial of service or potential privilege escalation.

Affected Products

Linux kernel versions containing the dm-pcache device-mapper target prior to the fix commits
Stable kernel branches referenced in commits 62d92e45, 91b93fe5, and e889c0ee
Distributions shipping the affected dm-pcache code path

Discovery Timeline

2026-09-11 - CVE-2026-80960 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80960

Vulnerability Analysis

The dm-pcache target uses persistent memory as a cache backing store. During table load, the kernel reads a superblock from the supplied cache device and trusts the seg_num field it contains. That field controls the size of the cache->segments[] array and bounds every subsequent on-media segment identifier. The superblock is protected only by a CRC32C checksum, which offers no authenticity guarantee against an operator who controls the device contents.

Because cache_dev->mapping directly maps the pmem region, computing CACHE_DEV_SEGMENT() for a segment identifier past the end of the device produces a pointer into kernel memory beyond the intended mapping. When cache initialization walks segments, cache_seg_init() invokes cache_dev_zero_range(), which issues a 12 KiB memset() at that out-of-bounds address. The result is an out-of-bounds write into the kernel heap at table load time [CWE-787].

Root Cause

The root cause is missing input validation. The kernel accepts seg_num from attacker-influenced on-media metadata without comparing it to the physical capacity of the cache device or to the compile-time upper bound PCACHE_CACHE_SEGS_MAX. A seg_num value of zero additionally causes segment allocations to return ZERO_SIZE_PTR, which downstream code dereferences unsafely.

Attack Vector

Exploitation requires local access and CAP_SYS_ADMIN to invoke a device-mapper table load. The attacker crafts a cache device whose superblock advertises a seg_num larger than the device can hold, or equal to zero. Loading that device via dmsetup triggers the out-of-bounds memset() during cache_seg_init(). The fix rejects seg_num values that are zero, exceed device capacity, or exceed PCACHE_CACHE_SEGS_MAX before they are used. See the upstream commits 62d92e45, 91b93fe5, and e889c0ee for the corrective validation logic.

Detection Methods for CVE-2026-80960

Indicators of Compromise

Unexpected kernel oops or slab corruption warnings following dmsetup create or dmsetup load operations targeting pcache devices
Kernel log entries referencing dm-pcache, cache_seg_init, or cache_dev_zero_range around the time of a table load
Presence of untrusted pmem or block devices being registered as dm-pcache backing stores

Detection Strategies

Audit invocations of dmsetup and device-mapper ioctls to identify processes creating pcache targets outside expected administrative workflows
Correlate CAP_SYS_ADMIN process activity with device-mapper table loads in host telemetry
Monitor kernel taint flags and KASAN reports on hosts running kernels with dm-pcache compiled in

Monitoring Recommendations

Ingest kernel and audit logs into a central data lake and alert on dm-pcache initialization errors
Track loaded kernel modules and verify that dm_pcache is only present on hosts that require it
Alert on new block devices being enrolled as cache devices by non-standard accounts

How to Mitigate CVE-2026-80960

Immediate Actions Required

Apply kernel updates that include commits 62d92e45, 91b93fe5, and e889c0ee on all systems using dm-pcache
Restrict CAP_SYS_ADMIN and access to device-mapper ioctls to trusted administrators only
Inventory systems with the dm_pcache module loaded and prioritize them for patching

Patch Information

The upstream fix validates seg_num before it is used. The kernel now rejects values that are zero, larger than the cache device can hold, or larger than PCACHE_CACHE_SEGS_MAX. Patches are available in the stable kernel commits 62d92e45, 91b93fe5, and e889c0ee. Consume the fix through your distribution's kernel updates.

Workarounds

Blacklist the dm_pcache module on systems that do not require pmem-backed caching using /etc/modprobe.d/ configuration
Prevent non-administrative users from loading kernel modules or invoking device-mapper operations
Restrict physical and virtual access to pmem devices that could be registered as dm-pcache cache backing stores

bash

# Blacklist dm-pcache on hosts that do not need it
echo "blacklist dm_pcache" | sudo tee /etc/modprobe.d/blacklist-dm-pcache.conf
sudo depmod -a

# Verify the module is not currently loaded
lsmod | grep dm_pcache