---
id: CVE-2026-80962
title: 'dm-pcache: validate geometry fields from on-disk cache_info'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-pcache: validate geometry fields from on-disk cache_info

  cache_segs_init() iterates cache_info->n_segs times indexing
  cache->segments[], which is sized to the cache…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    ab5dcde6fa96bc115b85f3621c60e39c66229a90
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    3e19172089ec81132a8a48e802b1034a744209f4
  - >-
    Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 <
    32d1809da31094ef76fd98dc1f1a8b55ca1295dd
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:46.216Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80962'
references:
  - url: 'https://git.kernel.org/stable/c/ab5dcde6fa96bc115b85f3621c60e39c66229a90'
  - url: 'https://git.kernel.org/stable/c/3e19172089ec81132a8a48e802b1034a744209f4'
  - url: 'https://git.kernel.org/stable/c/32d1809da31094ef76fd98dc1f1a8b55ca1295dd'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80962.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80962'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532323'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80962'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80962'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80962.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00173
epssPercentile: 0.06721
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: validate geometry fields from on-disk cache_info

cache_segs_init() iterates cache_info->n_segs times indexing
cache->segments[], which is sized to the cache device geometry, and
get_seg_id() takes each segment id from the on-media cache_info and the
per-segment next_seg link. Both come from cache device metadata that is
only CRC-protected with a fixed public seed, so whoever supplies the
cache device on a table load (CAP_SYS_ADMIN) controls them: an oversized
n_segs or an out-of-range id drives an out-of-bounds access of
cache->segments[] and a wild CACHE_DEV_SEGMENT() pointer into the device
mapping -- an out-of-bounds read and write from on-disk data.

Reject an n_segs that exceeds the device segment count and a segment id
that is out of range before either is used. Valid metadata is unaffected.

## Affected

- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < ab5dcde6fa96bc115b85f3621c60e39c66229a90`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 3e19172089ec81132a8a48e802b1034a744209f4`
- `Linux >= 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 < 32d1809da31094ef76fd98dc1f1a8b55ca1295dd`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80962.json)