Linux Linux Kernel Vulnerability Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-93201

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate seg_id fields from persistent memory

cache_pos_decode(), cache_key_decode() and the last-kset branches of

cache_replay(), the writeback worker and the GC worker take a cache

segment id from the cache device metadata and index cache->segments[]

with it without checking it against cache->n_segs. That metadata is only

CRC-protected with a fixed public seed, so whoever supplies the cache

device on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range

value forms a wild pcache_cache_segment pointer that is dereferenced and

written through -- an out-of-bounds read and write driven by on-disk data.

Add cache_seg_id_valid() and reject an out-of-range id at each decode

site, failing the operation with -EIO instead of indexing past the array.

Bound the id against the initialized-segment count (cache_info.n_segs)

rather than the physical device total. A forged cache_info.n_segs below

seg_num otherwise leaves segments[cache_info.n_segs..seg_num) as zeroed

structs whose data pointer is NULL, so a forged id in that window would

still be dereferenced. A later patch guarantees cache_info.n_segs <=

seg_num, and a driver-created cache sets the two equal, so valid images

are unaffected. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References