CVE-2026-93201

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate seg_id fields from persistent memory

cache_pos_decode(), cache_key_decode() and the last-kset branches of

cache_replay(), the writeback worker and the GC worker take a cache

segment id from the cache device metadata and index cache->segments[]

with it without checking it against cache->n_segs. That metadata is only

CRC-protected with a fixed public seed, so whoever supplies the cache

device on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range

value forms a wild pcache_cache_segment pointer that is dereferenced and

written through -- an out-of-bounds read and write driven by on-disk data.

Add cache_seg_id_valid() and reject an out-of-range id at each decode

site, failing the operation with -EIO instead of indexing past the array.

Bound the id against the initialized-segment count (cache_info.n_segs)

rather than the physical device total. A forged cache_info.n_segs below

seg_num otherwi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References