CVE-2026-80961: Linux Kernel dm-pcache Info Disclosure Flaw

CVE-2026-80961 Overview

CVE-2026-80961 is a Linux kernel vulnerability in the dm-pcache device-mapper target. Two fields decoded from a cache device are used without bounds checking, producing an out-of-bounds read that can leak adjacent persistent memory into user space through a bio buffer. The key_num field drives cache_kset_crc() and the replay loop in cache_replay(), while a key's intra-segment offset and length in cache_key_decode() are trusted as-is. An actor with CAP_SYS_ADMIN who supplies the cache device can trigger the read past the PCACHE_KSET_KEYS_MAX buffer or past a segment's data_size.

Critical Impact
A local privileged actor supplying a crafted cache device can cause the kernel to read out of bounds and leak persistent memory contents to user space through subsequent bio reads.

Affected Products

Linux kernel branches containing the dm-pcache device-mapper target prior to the fix commits
Distributions shipping the affected mainline commits before backport
Systems that expose dm-pcache to administrators who can attach untrusted cache devices

Discovery Timeline

2026-09-11 - CVE-2026-80961 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80961

Vulnerability Analysis

The dm-pcache target decodes on-disk metadata from an attached cache device. Two fields are consumed without validation. First, the kset key_num value determines how many keys cache_kset_crc() hashes and how many entries the replay, writeback, and garbage-collection workers walk. Only the kset magic and a fixed-seed CRC are checked before this field is used. Because the CRC seed is public, a non-last kset with a key_num greater than PCACHE_KSET_KEYS_MAX causes reads past the end of the buffer before the CRC is compared.

Second, cache_key_decode() accepts each key's intra-segment offset and length verbatim. A key that runs past its segment is inserted into the cache tree. Later data CRC checks and every subsequent read hit copy adjacent persistent memory into the caller's bio. That memory is returned to user space, producing an information disclosure primitive.

Root Cause

Missing input validation on attacker-controlled metadata fields decoded from the cache device. The kset key count and per-key segment bounds are not verified before being used to index buffers and drive replay logic. This is an Out-of-Bounds Read rooted in improper input validation of on-disk structures.

Attack Vector

Exploitation requires local access with CAP_SYS_ADMIN to supply the cache device backing a dm-pcache target. The attacker crafts kset metadata whose key_num exceeds PCACHE_KSET_KEYS_MAX, or a key whose offset + length exceeds the segment data_size. Once the target is activated, kernel workers or subsequent read I/O return adjacent persistent memory contents through the bio path. No user interaction is required beyond attaching the crafted device.

See the upstream fixes in the kernel Git history: Kernel Git Commit 5ac38f4, Kernel Git Commit d8caf96, and Kernel Git Commit f11deb0.

Detection Methods for CVE-2026-80961

Indicators of Compromise

Creation of dm-pcache device-mapper targets backed by cache devices that were not provisioned by trusted administrators or automation.
Kernel log entries from the dm-pcache subsystem referencing CRC mismatches, replay errors, or key decoding failures on unfamiliar cache devices.
Unexpected dmsetup create invocations that attach removable or user-controlled block devices as pcache backing storage.

Detection Strategies

Audit process execution for dmsetup and related device-mapper tooling used to construct dm-pcache targets, correlating on the invoking user and parent process.
Monitor CAP_SYS_ADMIN grants and namespaced privilege escalations that could enable non-root actors to configure device-mapper targets.
Alert on kernel messages emitted from cache_replay, cache_kset_crc, and cache_key_decode code paths after applying the upstream validation patches, since the new kset_onmedia_valid() check surfaces malformed metadata.

Monitoring Recommendations

Ship kernel ring buffer logs and audit records to a centralized data store and retain them for post-incident review.
Track block device attachments and device-mapper table changes on hosts that use dm-pcache in production.
Baseline expected cache device UUIDs and flag activations that fall outside the baseline.

How to Mitigate CVE-2026-80961

Immediate Actions Required

Apply the upstream fixes referenced in the kernel Git commits, which introduce kset_onmedia_valid() and enforce that a key's offset + length computed in 64-bit arithmetic does not exceed the segment data_size.
Restrict CAP_SYS_ADMIN to a minimal set of trusted administrators and avoid granting it inside container or multi-tenant workloads.
Inventory hosts where the dm-pcache target is loaded and prioritize them for kernel updates.

Patch Information

The issue is resolved by the upstream commits 5ac38f4b4862fad6e7270fde5c3356a822ce74ca, d8caf96040a06096276ab72f5e1e8547c014c564, and f11deb032fd84081e7831cffcba895d893054a22. Rebuild and install kernels from a stable branch that includes these commits, or install vendor packages once distributions publish backports. Valid metadata is unaffected by the new checks.

Workarounds

Unload or blocklist the dm-pcache module on systems that do not require it until a patched kernel is deployed.
Prevent unprivileged or semi-trusted users from attaching arbitrary block devices as cache backing storage through udev rules and mount policies.
Use signed or attested storage provisioning workflows so that only trusted cache devices can be attached to dm-pcache targets.

bash

# Verify whether dm-pcache is loaded and, if unused, prevent it from loading
lsmod | grep -i pcache
echo 'blacklist dm_pcache' | sudo tee /etc/modprobe.d/blacklist-dm-pcache.conf
sudo depmod -a