CVE-2026-80956

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: only hand out initialized cache segments

get cache segment() scans the segment map up to cache->n segs, the physical device segment count, but cache segs init() only initializes the first cache info->n segs segments. A crafted image with cache info->n segs smaller than the device count leaves the remaining pcache cache segment structs zeroed (segment.data == NULL), and the allocator can hand one to cache kset close(), which writes through the returned segment's data pointer with no NULL check.

Bound the allocator's search to cache info->n segs so only initialized segments are ever returned. A conforming cache sets n segs equal to the device segment count, so this rejects nothing legitimate.