---
id: CVE-2026-80955
title: 'dm-pcache: fix use-after-free and invalid seg operations in kset_replay()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

  In kset_replay, when key->seg_gen is stale (key->seg_gen <
  key->cache_pos.cache_seg->gen), ca…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    1894fc7a3bab90143dcd26ef8ee27040ef4a7501
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    f39a3e9cc5946473e16d6f5071b2ee0216c56d06
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    c2e894eac398b258f12fdec73ed6ba081047f7b3
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:39.156Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80955'
references:
  - url: 'https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501'
  - url: 'https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06'
  - url: 'https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80955.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80955'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532031'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80955'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80955'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80955.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00168
epssPercentile: 0.06141
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

In kset_replay, when key->seg_gen is stale (key->seg_gen <
key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then
key->cache_pos.cache_seg is accessed as the argument to cache_seg_get().
This is a use-after-free on the freed key memory. Although mempool
recycled memory is not immediately reclaimed or overwritten in practice,
this is still a potential UAF bug.

Additionally, for expired invalid keys, setting the cache->seg_map bit
and calling cache_seg_get() is unreasonable since the corresponding
segment data is no longer valid.

Fix both issues by moving cache_seg_get() and __set_bit() after the
gen check, so they only execute for valid keys, and using continue to
skip invalid keys.

## Affected

- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 1894fc7a3bab90143dcd26ef8ee27040ef4a7501`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < f39a3e9cc5946473e16d6f5071b2ee0216c56d06`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < c2e894eac398b258f12fdec73ed6ba081047f7b3`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80955.json)