CVE-2026-93198 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate the persisted dirty_tail chain at load
The writeback worker follows the persisted dirty_tail chain, which is decoded from the cache device independently of the key_tail chain that cache_replay() walks and bounds. A crafted image, whose on-media fields are authenticated only by a crc32c with a fixed seed, can aim dirty_tail at a chain of last ksets that never terminates, so cache_writeback_fn() re-arms itself with no delay forever.
Walk the dirty_tail chain once at load with the same hop cap cache_replay() uses and fail the table load with -EIO if it does not reach an end within n_segs hops.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel device-mapper persistent cache subsystem contains a critical validation deficiency in its initialization routine that allows for denial of service attacks through resource exhaustion. The dm-pcache module manages writeback operations by maintaining two distinct chains: the key_tail chain, which is traversed and bounded during the replay phase via cache_replay(), and the dirty_tail chain, which guides the asynchronous writeback worker responsible for flushing modified data to persistent storage. While the former undergoes rigorous bounds checking to ensure it terminates correctly within expected segment limits, the latter was previously loaded directly from on-media metadata without equivalent validation logic at startup time. This architectural asymmetry creates a significant security gap where malformed or maliciously crafted cache images can exploit this lack of verification during system initialization.
The core technical flaw lies in the insufficient integrity checking of persisted dirty_tail structures when they are decoded from the device media. These fields rely solely on crc32c checksums with fixed seeds for authentication, which provides only basic error detection against accidental corruption rather than protection against intentional manipulation by an attacker who can control or influence the contents stored on disk. By crafting a specific image where the dirty_tail pointer forms a circular reference to a chain of last ksets that never terminates, an adversary can cause cache_writeback_fn() to continuously re-arm itself with zero delay intervals. This results in an infinite loop within the kernel space writeback worker thread, effectively consuming all available CPU cycles allocated to this process and preventing other critical system operations from proceeding normally.
From a functional perspective, this vulnerability leads directly to severe operational impact characterized by complete system unresponsiveness related to storage I/O scheduling. Since the affected component operates in kernel context without preemption limits during its loop execution, it effectively creates a local denial of service condition that can freeze systems relying on dm-pcache for performance optimization or data persistence guarantees. The attack does not require elevated privileges if an attacker has write access to the underlying block device hosting the cache image, making it particularly dangerous in multi-tenant environments or scenarios where disk images are sourced from untrusted repositories. Such infinite loops degrade overall system stability and can trigger kernel watchdog timeouts leading to automatic reboots, disrupting service availability across dependent applications.
To mitigate this risk, developers implemented a mandatory validation step during the table load phase that mirrors the hop cap mechanism used by cache_replay(). This fix ensures that any traversal of the dirty_tail chain is strictly bounded; if the chain fails to reach its expected endpoint within n_segs hops, the entire table loading process aborts immediately with an -EIO error code. This preventive measure stops malformed chains from ever entering active execution paths and protects against both accidental data corruption scenarios and deliberate exploitation attempts targeting this specific subsystem logic gap.
This vulnerability aligns closely with CWE-20 Improper Input Validation as it involves failing to verify the structural integrity of external inputs before processing them within a privileged context. Furthermore, its classification under ATT&CK technique T1499 Endpoint Denial of Service highlights how attackers leverage resource exhaustion through infinite loops or excessive computational demands to disrupt normal system functioning. The resolution emphasizes the importance of applying consistent validation boundaries across all data structures regardless of their specific role in complex subsystems like device-mapper caching layers, ensuring that no component bypasses standard safety checks during initialization sequences involving persistent state reconstruction from disk media.