CVE-2026-80962: Linux Kernel dm-pcache Buffer Overflow

CVE-2026-80962 Overview

CVE-2026-80962 affects the Linux kernel's dm-pcache device-mapper target. The flaw allows out-of-bounds reads and writes triggered by malformed cache device metadata. The cache_segs_init() function iterates cache_info->n_segs times while indexing cache->segments[], and get_seg_id() consumes segment identifiers directly from on-disk cache_info and per-segment next_seg links. Because this metadata is only CRC-protected with a fixed public seed, any principal with CAP_SYS_ADMIN who supplies the cache device on a table load controls those values. An oversized n_segs or an out-of-range segment id drives out-of-bounds access into cache->segments[] and produces a wild CACHE_DEV_SEGMENT() pointer.

Critical Impact
A local privileged actor can trigger out-of-bounds reads and writes in kernel memory by attaching a crafted cache device, leading to kernel memory corruption and potential privilege escalation.

Affected Products

Linux kernel builds that include the dm-pcache device-mapper target
Distributions shipping vulnerable stable kernel branches prior to the fix commits
Systems permitting CAP_SYS_ADMIN table loads against untrusted cache devices

Discovery Timeline

2026-09-11 - CVE-2026-80962 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80962

Vulnerability Analysis

The dm-pcache target uses on-disk cache_info metadata to describe the geometry of a persistent cache device. During initialization, cache_segs_init() walks the segment array using cache_info->n_segs as a loop bound and get_seg_id() to resolve each segment identifier. Both inputs originate from the cache device itself, and both are used to index cache->segments[], which is sized by the trusted device geometry. Because the on-disk structure is protected only by a CRC with a fixed, publicly known seed, integrity of the metadata cannot be assumed. A malformed n_segs value that exceeds the true segment count, or a segment id outside the valid range, causes the loop to index past the array boundary. The resulting CACHE_DEV_SEGMENT() computation returns a pointer outside the device mapping, which the driver then reads from and writes to as though it were a valid segment.

Root Cause

The root cause is missing input validation of geometry fields deserialized from attacker-controlled on-disk metadata. The CRC provides no authenticity guarantee because its seed is public. The driver accepts n_segs and segment identifiers without bounds checking them against the actual device geometry before using them to index cache->segments[]. This is an Out-of-Bounds Read and Out-of-Bounds Write condition rooted in improper input validation.

Attack Vector

Exploitation requires local access and CAP_SYS_ADMIN, which is needed to perform a device-mapper table load. An operator with those privileges supplies a crafted block device containing malformed cache_info metadata. When dm-pcache initializes the target, cache_segs_init() and get_seg_id() process the attacker-controlled fields, triggering out-of-bounds access into cache->segments[]. The wild pointer returned by CACHE_DEV_SEGMENT() produces reads and writes at attacker-influenced offsets, enabling kernel memory corruption. See the upstream patches for the validation logic added by the fix: Kernel Git Commit Fix, Kernel Git Commit Update, and Kernel Git Commit Enhancement.

No public exploit code is available for this issue. Refer to the upstream commits for the exact validation logic and affected code paths.

Detection Methods for CVE-2026-80962

Indicators of Compromise

Unexpected dmsetup create or device-mapper table load events referencing pcache targets backed by unfamiliar block devices.
Kernel log entries showing dm-pcache initialization errors, oops messages, or KASAN reports involving cache_segs_init, get_seg_id, or CACHE_DEV_SEGMENT.
Presence of loop devices or removable media attached immediately before a dm-pcache table load by a non-service account with elevated privileges.

Detection Strategies

Audit CAP_SYS_ADMIN usage and device-mapper ioctl() calls, focusing on DM_TABLE_LOAD_CMD invocations that specify the pcache target type.
Correlate block-device attachment events with subsequent device-mapper activity to identify anomalous cache device assemblies.
Enable KASAN on test and staging kernels to surface the out-of-bounds access when malformed metadata is processed.

Monitoring Recommendations

Forward kernel ring buffer output and auditd records to a central logging pipeline and alert on dm-pcache panics or splats.
Track which users and services legitimately create device-mapper targets, and flag deviations from that baseline.
Monitor for the introduction of new kernel modules or targets in environments where dm-pcache is not expected to be used.

How to Mitigate CVE-2026-80962

Immediate Actions Required

Update to a kernel that includes the upstream fixes referenced in the Kernel Git Commit Fix.
Restrict CAP_SYS_ADMIN to a minimal set of trusted administrative accounts and services.
Prevent unprivileged mounting and device-mapper operations on removable or user-supplied block devices.

Patch Information

The upstream fix rejects an n_segs value that exceeds the device segment count and any segment id that is out of range before either value is used to index cache->segments[]. Valid metadata is unaffected. Distributions should backport the changes referenced in the Kernel Git Commit Update and the Kernel Git Commit Enhancement. Apply the vendor kernel update as soon as it is available for your distribution.

Workarounds

Blacklist or unload the dm-pcache module on systems that do not require persistent cache functionality.
Enforce strict allowlisting of block devices permitted to back device-mapper targets through udev or storage policy tooling.
Use Mandatory Access Control profiles such as SELinux or AppArmor to constrain which processes may issue device-mapper ioctl() calls.

bash

# Prevent the vulnerable module from loading until the kernel is patched
echo "install dm_pcache /bin/false" | sudo tee /etc/modprobe.d/disable-dm-pcache.conf
sudo rmmod dm_pcache 2>/dev/null || true