---
id: CVE-2026-80958
title: 'dm-pcache: clamp the tail kset read to the segment data region'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-pcache: clamp the tail kset read to the segment data region

  The tail-kset read in cache_replay(), the writeback worker and the GC
  worker bounds its length by PCACHE…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    1ab55354368d071ebaee4d8c82313955eab65a04
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    becf07e2b0053027495ecd671b1f82fb2e615f68
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:42.221Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80958'
references:
  - url: 'https://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c'
  - url: 'https://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04'
  - url: 'https://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80958.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80958'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532108'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80958'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80958'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80958.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00164
epssPercentile: 0.05572
scores:
  cna: 7.1
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: clamp the tail kset read to the segment data region

The tail-kset read in cache_replay(), the writeback worker and the GC
worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment
size rather than the data region. A tail near the segment end reads past
the segment data into the following control area.

Clamp the read to cache_seg_remain(), the data region.

## Affected

- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 1ab55354368d071ebaee4d8c82313955eab65a04`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < becf07e2b0053027495ecd671b1f82fb2e615f68`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80958.json)