GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-80956

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-11 20:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments get_cache_segment() scans the segment map up to cache->n_segs, the physical device segment count, but cache_segs_init() only initializes the first cache_info->n_segs segments. A crafted image with cache_info->n_segs smaller than the device count leaves the remaining pcache_cache_segment structs zeroed (segment.data == NULL), and the allocator can hand one to cache_kset_close(), which writes through the returned segment's data pointer with no NULL check. Bound the allocator's search to cache_info->n_segs so only initialized segments are ever returned. A conforming cache sets n_segs equal to the device segment count, so this rejects nothing legitimate.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2df0fc042e299bae3c0f60ea5cd2af9285658e9f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/692037ae1a7cfacc2f0c22c6e034c1dfee0e553f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/83e3116283ed2c6a6a1fa662862a4b4d7d2701a2
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache_segment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83e3116283ed2c6a6a1fa662862a4b4d7d2701a2",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "692037ae1a7cfacc2f0c22c6e034c1dfee0e553f",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            },
            {
              "lessThan": "2df0fc042e299bae3c0f60ea5cd2af9285658e9f",
              "status": "affected",
              "version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-pcache/cache_segment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: only hand out initialized cache segments\n\nget_cache_segment() scans the segment map up to cache-\u003en_segs, the\nphysical device segment count, but cache_segs_init() only initializes\nthe first cache_info-\u003en_segs segments. A crafted image with\ncache_info-\u003en_segs smaller than the device count leaves the remaining\npcache_cache_segment structs zeroed (segment.data == NULL), and the\nallocator can hand one to cache_kset_close(), which writes through the\nreturned segment\u0027s data pointer with no NULL check.\n\nBound the allocator\u0027s search to cache_info-\u003en_segs so only initialized\nsegments are ever returned. A conforming cache sets n_segs equal to the\ndevice segment count, so this rejects nothing legitimate."
    }
  ],
  "id": "CVE-2026-80956",
  "lastModified": "2026-09-11T20:19:01.410",
  "metrics": {},
  "published": "2026-09-11T20:19:01.410",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2df0fc042e299bae3c0f60ea5cd2af9285658e9f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/692037ae1a7cfacc2f0c22c6e034c1dfee0e553f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/83e3116283ed2c6a6a1fa662862a4b4d7d2701a2"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.