GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80958 (GCVE-0-2026-80958)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
dm-pcache: clamp the tail kset read to the segment data region
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache_replay(), the writeback worker and the GC worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area. Clamp the read to cache_seg_remain(), the data region.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c (git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 1ab55354368d071ebaee4d8c82313955eab65a04 (git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < becf07e2b0053027495ecd671b1f82fb2e615f68 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache_gc.c",
            "drivers/md/dm-pcache/cache_key.c",
            "drivers/md/dm-pcache/cache_writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "1ab55354368d071ebaee4d8c82313955eab65a04",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "becf07e2b0053027495ecd671b1f82fb2e615f68",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache_gc.c",
            "drivers/md/dm-pcache/cache_key.c",
            "drivers/md/dm-pcache/cache_writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: clamp the tail kset read to the segment data region\n\nThe tail-kset read in cache_replay(), the writeback worker and the GC\nworker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment\nsize rather than the data region. A tail near the segment end reads past\nthe segment data into the following control area.\n\nClamp the read to cache_seg_remain(), the data region."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The over-read is reached only through local device-mapper ioctls on /dev/mapper/control (ctl_ioctl requires CAP_SYS_ADMIN, then table_load \u2192 dm_pcache_ctr \u2192 pcache_cache_start \u2192 cache_replay), and later via the writeback and GC workers on that mapped device; no network, Bluetooth, or physical-bus input reaches the kset copy.\nAC:L - An attacker who supplies a crafted DAX/pmem cache image fully controls the persisted key_tail and dirty_tail, so placing a tail near the segment end deterministically copies past data_size; no race, heap layout, or other victim state outside attacker control is required.\nPR:L - dm-ioctl.c gates table load with capable(CAP_SYS_ADMIN), which user-namespace and privileged-container administrators satisfy without init-namespace root; the attacker can attach a DAX cache device they control and load the pcache table themselves.\nUI:N - Exploitation requires only the attacker\u0027s own dmsetup/DM_TABLE_LOAD of a crafted pcache cache device; no separate victim must mount media, open files, or take any other action.\nS:U - The out-of-bounds kset read and any resulting kernel oops remain inside the host kernel device-mapper/pcache subsystem; this is not a VM escape, IOMMU bypass, or other cross-authority breakout.\nC:H - copy_mc_to_kernel() copies up to PCACHE_KSET_ONMEDIA_SIZE_MAX (~5 KiB) past segment data_size into the next segment\u0027s control area, and on the last segment that continues beyond the DAX mapping into adjacent kernel memory; out-of-bounds reads are High unless limited to a few bytes.\nI:N - The destination is a correctly sized kset buffer (kzalloc or the writeback/GC scratch arrays); this is a source over-read, not an out-of-bounds write, use-after-free, or other kernel-memory corruption or control-flow hijack primitive.\nA:H - Reading past the last DAX-mapped page hits a vmap guard or unmapped hole and oopses the kernel, and a CRC-valid kset assembled across the data/control boundary that is larger than cache_seg_remain() hits BUG_ON in cache_pos_advance(), crashing the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:30.422Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04"
        },
        {
          "url": "https://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68"
        }
      ],
      "title": "dm-pcache: clamp the tail kset read to the segment data region",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80958",
    "datePublished": "2026-09-11T19:42:25.861Z",
    "dateReserved": "2026-08-26T14:34:25.809Z",
    "dateUpdated": "2026-09-13T06:28:30.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80958",
      "date": "2026-09-18",
      "epss": "0.00124",
      "percentile": "0.02442"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-pcache/cache_gc.c",
                  "drivers/md/dm-pcache/cache_key.c",
                  "drivers/md/dm-pcache/cache_writeback.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c",
                    "status": "affected",
                    "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1ab55354368d071ebaee4d8c82313955eab65a04",
                    "status": "affected",
                    "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "becf07e2b0053027495ecd671b1f82fb2e615f68",
                    "status": "affected",
                    "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-pcache/cache_gc.c",
                  "drivers/md/dm-pcache/cache_key.c",
                  "drivers/md/dm-pcache/cache_writeback.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: clamp the tail kset read to the segment data region\n\nThe tail-kset read in cache_replay(), the writeback worker and the GC\nworker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment\nsize rather than the data region. A tail near the segment end reads past\nthe segment data into the following control area.\n\nClamp the read to cache_seg_remain(), the data region."
          }
        ],
        "id": "CVE-2026-80958",
        "lastModified": "2026-09-13T07:17:02.823",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:01.637",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:36:21+00:00",
      "cve": "CVE-2026-80958",
      "id": "CVE-2026-80958",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm-pcache: clamp the tail kset read to the segment data region",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80958.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:05:27Z",
      "cve": "CVE-2026-80958",
      "id": "CVE-2026-80958",
      "initial_release_date": "2026-09-12T16:36:57Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80958",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80958.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.