CVE-2026-80960

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description An issue exists in the dm-pcache module where the seg num read from the crc32c-only superblock is not validated against the cache device size. Since a user with CAP SYS ADMIN privileges controls the cache device during table load, they can provide a seg num that is zero or exceeds the device capacity. If a segment ID exceeds the device mapping, the CACHE DEV SEGMENT() function resolves to kernel memory beyond the mapping. This leads to an out-of-bounds write into the kernel heap via the cache seg init() and cache dev zero range() functions during new-cache initialization, resulting in a 12 KiB memory overwrite. Additionally, a seg num of zero causes segment allocations to be ZERO SIZE PTR.

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later.