CVE-2026-80961

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate kset key num and intra-segment bounds

Two more fields decoded from the cache device go unbounded. The kset key num drives cache kset crc() and the replay loop in cache replay(), the writeback worker and the GC worker, but only the magic and a fixed-seed CRC are checked first, so a non-last kset whose key num exceeds the PCACHE KSET KEYS MAX buffer reads past its end before the CRC compare. A key's intra-segment offset and length in cache key decode() are taken verbatim, so a key running past its segment is replayed into the cache tree and the data CRC check and every later read hit then copy adjacent persistent memory into the caller's bio -- an out-of-bounds read that leaks to user space. Both fields are controlled by whoever supplies the cache device (CAP SYS ADMIN); the CRC seed is public.

Add kset onmedia valid() to bound key num before any kset read, and reject a key whose offset plus length, computed in 64 bits, exceeds the segment data size. Valid metadata is unaffected.