CVE-2026-80960 dm-pcache: validate on-media seg_num against the cache device size
A local attacker with CAP_SYS_ADMIN can trigger an out-of-bounds write in the Linux kernel dm-pcache driver, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80960?
CVE-2026-80960 is a memory corruption vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate on-media seg_num against the cache device size
seg_num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes cache->segments[] and is the value every later on-media segment id is bounded against, yet it is never checked against the device. Because cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for a segment id past the device resolves to ordinary kernel memory beyond the mapping; a new-cache init reaching such an id has cache_seg_init() -> cache_dev_zero_range() memset() 12 KiB over that memory -- an out-of-bounds write into the kernel heap at table load. A zero seg_num makes the segment allocations ZERO_SIZE_PTR.
Reject a seg_num that is zero, larger than the device can hold, or larger than PCACHE_CACHE_SEGS_MAX before it is used.
Which versions are affected by CVE-2026-80960?
How do I fix CVE-2026-80960?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80960 being exploited?
There is no known exploitation of CVE-2026-80960 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80960, DEBIAN-CVE-2026-80960, GHSA-5phx-c495-rgx5, UBUNTU-CVE-2026-80960.