GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-93201 (GCVE-0-2026-93201)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:12 – Updated: 2026-09-18 17:56
VLAI
Title
dm-pcache: validate seg_id fields from persistent memory
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate seg_id fields from persistent memory cache_pos_decode(), cache_key_decode() and the last-kset branches of cache_replay(), the writeback worker and the GC worker take a cache segment id from the cache device metadata and index cache->segments[] with it without checking it against cache->n_segs. That metadata is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range value forms a wild pcache_cache_segment pointer that is dereferenced and written through -- an out-of-bounds read and write driven by on-disk data. Add cache_seg_id_valid() and reject an out-of-range id at each decode site, failing the operation with -EIO instead of indexing past the array. Bound the id against the initialized-segment count (cache_info.n_segs) rather than the physical device total. A forged cache_info.n_segs below seg_num otherwise leaves segments[cache_info.n_segs..seg_num) as zeroed structs whose data pointer is NULL, so a forged id in that window would still be dereferenced. A later patch guarantees cache_info.n_segs <= seg_num, and a driver-created cache sets the two equal, so valid images are unaffected.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < b4bf8af5e7d7db4c5e179e15017da55857761ac4 (git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 90c990a68460d7b5720e5634cf650eccdf0f4098 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache.c",
            "drivers/md/dm-pcache/cache.h",
            "drivers/md/dm-pcache/cache_gc.c",
            "drivers/md/dm-pcache/cache_key.c",
            "drivers/md/dm-pcache/cache_writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b4bf8af5e7d7db4c5e179e15017da55857761ac4",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "90c990a68460d7b5720e5634cf650eccdf0f4098",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache.c",
            "drivers/md/dm-pcache/cache.h",
            "drivers/md/dm-pcache/cache_gc.c",
            "drivers/md/dm-pcache/cache_key.c",
            "drivers/md/dm-pcache/cache_writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: validate seg_id fields from persistent memory\n\ncache_pos_decode(), cache_key_decode() and the last-kset branches of\ncache_replay(), the writeback worker and the GC worker take a cache\nsegment id from the cache device metadata and index cache-\u003esegments[]\nwith it without checking it against cache-\u003en_segs. That metadata is only\nCRC-protected with a fixed public seed, so whoever supplies the cache\ndevice on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range\nvalue forms a wild pcache_cache_segment pointer that is dereferenced and\nwritten through -- an out-of-bounds read and write driven by on-disk data.\n\nAdd cache_seg_id_valid() and reject an out-of-range id at each decode\nsite, failing the operation with -EIO instead of indexing past the array.\nBound the id against the initialized-segment count (cache_info.n_segs)\nrather than the physical device total. A forged cache_info.n_segs below\nseg_num otherwise leaves segments[cache_info.n_segs..seg_num) as zeroed\nstructs whose data pointer is NULL, so a forged id in that window would\nstill be dereferenced. A later patch guarantees cache_info.n_segs \u003c=\nseg_num, and a driver-created cache sets the two equal, so valid images\nare unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Attacker-controlled cache_seg_id/next_cache_seg_id bytes are consumed only on a local DM_TABLE_LOAD of a pcache target (ctl_ioctl \u2192 table_load \u2192 dm_pcache_ctr \u2192 pcache_cache_start \u2192 cache_pos_decode/cache_key_decode/cache_replay) from a supplied DAX cache device; no network, Bluetooth, or USB receive path parses those on-media ids.\nAC:L - The attacker forges pos_onmedia.cache_seg_id, key_onmedia.cache_seg_id and last-kset next_cache_seg_id with a valid CRC because PCACHE_CRC_SEED (0x3B15A) is public, so a crafted INIT_DONE image makes cache_pos_decode/cache_key_decode/cache_replay index cache-\u003esegments[] out of bounds on every table load with no race.\nPR:L - ctl_ioctl in dm-ioctl.c gates DM_TABLE_LOAD with capable(CAP_SYS_ADMIN); kernel-CNA scoring of dm-pcache table-load bugs treats that delegated capability (privileged containers, LVM/storage helpers that already hold mapper and DAX/pmem nodes) as Low rather than exclusive init-namespace root.\nUI:N - The attacker writes the forged cache_seg_id fields onto their DAX cache device and issues DM_TABLE_LOAD for the pcache target themselves; no separate victim must mount media, open a file, or otherwise interact.\nS:U - The wild pcache_cache_segment taken as \u0026cache-\u003esegments[id] and the resulting kvalloc/DAX-mapping corruption stay inside the host kernel that loaded the table; this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:H - An out-of-range id makes cache_pos_decode, cache_key_decode and cache_replay\u0027s last-kset branch take \u0026cache-\u003esegments[id] past the kvalloc\u0027d array; cache_pos_addr() then copy_mc_to_kernel of a kset, and cache_key_data_crc() crc32c of key-\u003elen bytes, read through the fake object\u0027s segment.data \u2014 an unbounded kernel over-read.\nI:H - last_kset_gc/last_kset_writeback store the wild segment pointer into key_tail/dirty_tail; cache_replay then __set_bit()s cache_seg_id from that OOB object into cache-\u003eseg_map, and cache_seg_get/cache_seg_put \u2192 cache_seg_ctrl_write memcpy_flushcache through the fake cache_seg_ctrl pointer, an out-of-bounds kernel write.\nA:H - Indexing past cache-\u003esegments[], or a forged id in [cache_info.n_segs, seg_num) whose kvzalloc\u0027d slot has segment.data NULL, makes cache_pos_addr() and later copy_mc_to_kernel/memcpy_flushcache walk a NULL or unmapped kernel VA during table load or in the GC/writeback workers, oopsing or panicking the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:56:31.622Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b4bf8af5e7d7db4c5e179e15017da55857761ac4"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c990a68460d7b5720e5634cf650eccdf0f4098"
        }
      ],
      "title": "dm-pcache: validate seg_id fields from persistent memory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93201",
    "datePublished": "2026-09-17T16:12:22.392Z",
    "dateReserved": "2026-09-17T16:02:15.092Z",
    "dateUpdated": "2026-09-18T17:56:31.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93201",
      "date": "2026-09-19",
      "epss": "0.00112",
      "percentile": "0.01562"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-pcache/cache.c",
                  "drivers/md/dm-pcache/cache.h",
                  "drivers/md/dm-pcache/cache_gc.c",
                  "drivers/md/dm-pcache/cache_key.c",
                  "drivers/md/dm-pcache/cache_writeback.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b4bf8af5e7d7db4c5e179e15017da55857761ac4",
                    "status": "affected",
                    "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90c990a68460d7b5720e5634cf650eccdf0f4098",
                    "status": "affected",
                    "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-pcache/cache.c",
                  "drivers/md/dm-pcache/cache.h",
                  "drivers/md/dm-pcache/cache_gc.c",
                  "drivers/md/dm-pcache/cache_key.c",
                  "drivers/md/dm-pcache/cache_writeback.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: validate seg_id fields from persistent memory\n\ncache_pos_decode(), cache_key_decode() and the last-kset branches of\ncache_replay(), the writeback worker and the GC worker take a cache\nsegment id from the cache device metadata and index cache-\u003esegments[]\nwith it without checking it against cache-\u003en_segs. That metadata is only\nCRC-protected with a fixed public seed, so whoever supplies the cache\ndevice on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range\nvalue forms a wild pcache_cache_segment pointer that is dereferenced and\nwritten through -- an out-of-bounds read and write driven by on-disk data.\n\nAdd cache_seg_id_valid() and reject an out-of-range id at each decode\nsite, failing the operation with -EIO instead of indexing past the array.\nBound the id against the initialized-segment count (cache_info.n_segs)\nrather than the physical device total. A forged cache_info.n_segs below\nseg_num otherwise leaves segments[cache_info.n_segs..seg_num) as zeroed\nstructs whose data pointer is NULL, so a forged id in that window would\nstill be dereferenced. A later patch guarantees cache_info.n_segs \u003c=\nseg_num, and a driver-created cache sets the two equal, so valid images\nare unaffected."
          }
        ],
        "id": "CVE-2026-93201",
        "lastModified": "2026-09-18T18:18:24.903",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:16.403",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/90c990a68460d7b5720e5634cf650eccdf0f4098"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b4bf8af5e7d7db4c5e179e15017da55857761ac4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.