GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80955 (GCVE-0-2026-80955)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug. Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid. Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 1894fc7a3bab90143dcd26ef8ee27040ef4a7501 (git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < f39a3e9cc5946473e16d6f5071b2ee0216c56d06 (git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < c2e894eac398b258f12fdec73ed6ba081047f7b3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache_key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1894fc7a3bab90143dcd26ef8ee27040ef4a7501",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "f39a3e9cc5946473e16d6f5071b2ee0216c56d06",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "c2e894eac398b258f12fdec73ed6ba081047f7b3",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache_key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: fix use-after-free and invalid seg operations in kset_replay()\n\nIn kset_replay, when key-\u003eseg_gen is stale (key-\u003eseg_gen \u003c\nkey-\u003ecache_pos.cache_seg-\u003egen), cache_key_put(key) is called but then\nkey-\u003ecache_pos.cache_seg is accessed as the argument to cache_seg_get().\nThis is a use-after-free on the freed key memory. Although mempool\nrecycled memory is not immediately reclaimed or overwritten in practice,\nthis is still a potential UAF bug.\n\nAdditionally, for expired invalid keys, setting the cache-\u003eseg_map bit\nand calling cache_seg_get() is unreasonable since the corresponding\nsegment data is no longer valid.\n\nFix both issues by moving cache_seg_get() and __set_bit() after the\ngen check, so they only execute for valid keys, and using continue to\nskip invalid keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only via local device-mapper ioctls on /dev/mapper/control (ctl_ioctl \u2192 table_load \u2192 dm_pcache_ctr \u2192 pcache_start \u2192 pcache_cache_start \u2192 cache_init_req_keys \u2192 cache_replay \u2192 kset_replay). No network, Bluetooth, or physical-bus path feeds this replay code.\nAC:L - The attacker fully controls the DAX cache-device image, including kset records (CRC uses public PCACHE_CRC_SEED 0x3B15A) and per-segment gen metadata, so they can deterministically encode keys with seg_gen \u003c cache_seg-\u003egen and hit the free-then-use on every table load; no race or victim-side state is required.\nPR:L - ctl_ioctl gates DM_TABLE_LOAD with capable(CAP_SYS_ADMIN), which is obtainable inside an unprivileged user namespace (and in storage containers with delegated mapper/DAX nodes); per kernel CNA guidance that is Low, not init-namespace root only.\nUI:N - Exploitation requires only the attacker\u0027s own dmsetup/DM_TABLE_LOAD of a pcache target whose cache device holds crafted INIT_DONE ksets; no separate victim must mount media, open a file, or otherwise interact.\nS:U - The use-after-free is of a pcache_cache_key in the req_key_tree mempool and of cache seg_map/segment refcounts inside the host kernel; it does not cross a VM, hypervisor, IOMMU, or other separate security-authority boundary.\nC:H - On a stale key, cache_key_put() mempool-frees the decoded pcache_cache_key and kset_replay then reads key-\u003ecache_pos.cache_seg from that freed heap object. A kernel UAF of a slab/mempool object enables reclaim and an arbitrary read primitive, so confidentiality is High.\nI:H - The dangling key is passed to cache_seg_get(), which atomic_inc()s refs on the pointer loaded from freed memory, and the stale path also __set_bit()s cache-\u003eseg_map before the gen check. That UAF write/refcount primitive is Integrity High and is exploitable for control-flow hijack after spraying.\nA:H - Using the freed cache key (and inflating segment refs plus seg_map bits for invalid keys) can oops or panic on poisoned/reused mempool memory or under KASAN/slub debug; any kernel crash from this UAF is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:29.166Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501"
        },
        {
          "url": "https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3"
        }
      ],
      "title": "dm-pcache: fix use-after-free and invalid seg operations in kset_replay()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80955",
    "datePublished": "2026-09-11T19:42:23.838Z",
    "dateReserved": "2026-08-26T14:34:25.804Z",
    "dateUpdated": "2026-09-13T06:28:29.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80955",
      "date": "2026-09-17",
      "epss": "0.00157",
      "percentile": "0.05263"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80955\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:01.287\",\"lastModified\":\"2026-09-13T07:17:02.700\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm-pcache: fix use-after-free and invalid seg operations in kset_replay()\\n\\nIn kset_replay, when key-\u003eseg_gen is stale (key-\u003eseg_gen \u003c\\nkey-\u003ecache_pos.cache_seg-\u003egen), cache_key_put(key) is called but then\\nkey-\u003ecache_pos.cache_seg is accessed as the argument to cache_seg_get().\\nThis is a use-after-free on the freed key memory. Although mempool\\nrecycled memory is not immediately reclaimed or overwritten in practice,\\nthis is still a potential UAF bug.\\n\\nAdditionally, for expired invalid keys, setting the cache-\u003eseg_map bit\\nand calling cache_seg_get() is unreasonable since the corresponding\\nsegment data is no longer valid.\\n\\nFix both issues by moving cache_seg_get() and __set_bit() after the\\ngen check, so they only execute for valid keys, and using continue to\\nskip invalid keys.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm-pcache/cache_key.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\"lessThan\":\"1894fc7a3bab90143dcd26ef8ee27040ef4a7501\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\"lessThan\":\"f39a3e9cc5946473e16d6f5071b2ee0216c56d06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d57628ff95b32d5cfa8d8f50e07690c161e9cf0\",\"lessThan\":\"c2e894eac398b258f12fdec73ed6ba081047f7b3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm-pcache/cache_key.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T14:48:39+00:00",
      "cve": "CVE-2026-80955",
      "id": "CVE-2026-80955",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm-pcache: fix use-after-free and invalid seg operations in kset_replay()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80955.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:05:32Z",
      "cve": "CVE-2026-80955",
      "id": "CVE-2026-80955",
      "initial_release_date": "2026-09-15T01:05:32Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80955",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80955.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.