CVE-2026-80956

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: only hand out initialized cache segments

get_cache_segment() scans the segment map up to cache->n_segs, the

physical device segment count, but cache_segs_init() only initializes

the first cache_info->n_segs segments. A crafted image with

cache_info->n_segs smaller than the device count leaves the remaining

pcache_cache_segment structs zeroed (segment.data == NULL), and the

allocator can hand one to cache_kset_close(), which writes through the

returned segment's data pointer with no NULL check.

Bound the allocator's search to cache_info->n_segs so only initialized

segments are ever returned. A conforming cache sets n_segs equal to the

device segment count, so this rejects nothing legitimate.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References