CVE-2026-80960

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate on-media seg num against the cache device size

seg num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP SYS ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache dev->mapping is the direct map of the pmem, CACHE DEV SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache seg init() -> cache dev zero range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg num makes the segment allocations ZERO SIZE PTR.

Reject a seg num that is zero, larger than the device can hold, or larger than PCACHE CACHE SEGS MAX before it is used.