CVE-2026-80955

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: fix use-after-free and invalid seg operations in kset replay()

In kset replay, when key->seg gen is stale (key->seg gen < key->cache pos.cache seg->gen), cache key put(key) is called but then key->cache pos.cache seg is accessed as the argument to cache seg get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug.

Additionally, for expired invalid keys, setting the cache->seg map bit and calling cache seg get() is unreasonable since the corresponding segment data is no longer valid.

Fix both issues by moving cache seg get() and set bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.