CVE-2026-80961 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate kset key_num and intra-segment bounds
Two more fields decoded from the cache device go unbounded. The kset key_num drives cache_kset_crc() and the replay loop in cache_replay(), the writeback worker and the GC worker, but only the magic and a fixed-seed CRC are checked first, so a non-last kset whose key_num exceeds the PCACHE_KSET_KEYS_MAX buffer reads past its end before the CRC compare. A key's intra-segment offset and length in cache_key_decode() are taken verbatim, so a key running past its segment is replayed into the cache tree and the data CRC check and every later read hit then copy adjacent persistent memory into the caller's bio -- an out-of-bounds read that leaks to user space. Both fields are controlled by whoever supplies the cache device (CAP_SYS_ADMIN); the CRC seed is public.
Add kset_onmedia_valid() to bound key_num before any kset read, and reject a key whose offset plus length, computed in 64 bits, exceeds the segment data_size. Valid metadata is unaffected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The Linux kernel's device-mapper persistent cache (dm-pcache) subsystem contains critical input validation flaws that allow for out-of-bounds memory reads and potential information leakage to user space. These vulnerabilities stem from insufficient boundary checks on two specific fields decoded from the cache device metadata: the kset key_num and the intra-segment offset and length of a cache key. The root cause lies in the order of operations during data processing, where integrity checks such as magic number verification and cyclic redundancy check (CRC) validation are performed before ensuring that structural indices remain within allocated buffer limits. This architectural oversight permits malformed or maliciously crafted metadata to bypass initial security gates and trigger unsafe memory access patterns downstream in critical kernel subsystems responsible for cache management and garbage collection.
The first vulnerability involves the kset key_num field, which drives functions such as cache_kset_crc(), the replay loop within cache_replay(), the writeback worker, and the garbage collection (GC) worker. In the current implementation, only the magic number and a fixed-seed CRC are validated before accessing data structures indexed by this key. If a non-last kset presents a key_num value exceeding PCACHE_KSET_KEYS_MAX, the kernel proceeds to read past the end of the allocated buffer during the CRC comparison phase. This constitutes an out-of-bounds read where sensitive kernel memory adjacent to the intended structure is accessed without proper bounds checking. Although this specific flaw primarily affects internal consistency checks rather than direct user-facing output in all code paths, it represents a significant deviation from secure coding practices and can lead to undefined behavior or crashes depending on the state of adjacent memory regions.
The second vulnerability presents a more severe risk involving data integrity and confidentiality during cache key decoding. The intra-segment offset and length fields are taken verbatim without validation against the segment's actual data_size limit. When a crafted key specifies an offset plus length that exceeds the boundaries of its assigned segment, the replay mechanism writes this invalid entry into the cache tree. Subsequently, when subsequent read operations hit these corrupted entries, the system copies adjacent persistent memory contents directly into the caller's bio buffer. This results in a direct out-of-bounds read where data from outside the intended logical block is exposed to user space applications interacting with the device-mapper target. Since the CRC seed used for validation is public and the metadata structure is supplied by entities holding CAP_SYS_ADMIN privileges, an attacker with administrative access can deliberately construct malformed cache devices to exploit this flaw, leading to unauthorized disclosure of kernel memory contents that may contain sensitive information from other processes or subsystems.
These vulnerabilities are classified under CWE-125 (Out-of-bounds Read) and align with ATT&CK techniques related to Tactic TA0009 (Collection), specifically Data from Local System, as they enable the exfiltration of memory contents through legitimate I/O paths. The impact extends beyond simple information disclosure; it undermines the integrity guarantees provided by device-mapper targets and can facilitate further exploitation if combined with other kernel weaknesses. The fact that these fields are controlled by CAP_SYS_ADMIN users means that while local privilege escalation is not directly implied, the attack surface for malicious insiders or compromised administrative accounts is significantly expanded, allowing them to destabilize system stability or leak confidential data across security boundaries.
To mitigate these risks, the Linux kernel has implemented a validation function named kset_onmedia_valid() which enforces strict bounds checking on key_num before any read operations are performed against the kset array. This ensures that indices remain within the PCACHE_KSET_KEYS_MAX limit during CRC calculations and replay loops. Additionally, the cache_key_decode logic now computes the sum of offset and length in 64-bit arithmetic to prevent integer overflow issues and explicitly rejects keys where this total exceeds the segment's data_size field. These changes ensure that only well-formed metadata is processed by the cache subsystem, effectively closing the gap between initial validation and actual memory access. Valid metadata remains unaffected by these stricter checks, preserving backward compatibility while hardening the system against malformed inputs. System administrators should apply kernel updates containing these patches to prevent potential information leakage and maintain the integrity of persistent caching operations in enterprise environments relying on device-mapper targets for storage virtualization and performance optimization.