EUVD-2026-76282

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

CVE-2026-80959

CVE-2026-80959 affects the Linux kernel's dm-pcache (device-mapper persistent cache) component. The root cause is in cache_pos_decode() , which uses persisted key_tail and dirty_tail seg_off values to address data within a cache segment. A seg_off at or past the segment data_size , controllable b...

CVE-2026-80959 dm-pcache: bound the persisted tail-position offset

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

CVE-2026-80959

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

EUVD-2026-76281

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80958 dm-pcache: clamp the tail kset read to the segment data region

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80957

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...

CVE-2026-80958 dm-pcache: clamp the tail kset read to the segment data region

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80957 dm-pcache: detect a cycle in the last-kset chain during replay

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...

CVE-2026-80957

CVE-2026-80957 affects the dm-pcache subsystem in the Linux kernel . The function cache_replay() traverses the on-media last-kset chain via next_cache_seg_id without calling cond_resched(). A forged chain that points back into an already-visited segment causes the replay loop to iterate indefinit...

CVE-2026-80958

CVE-2026-80958 is a buffer over-read in the Linux kernel's dm-pcache (Device Mapper Persistent Cache) component. The tail-kset read performed by cache_replay(), the writeback worker, and the garbage collection (GC) worker incorrectly bounds its length by PCACHE_SEG_SIZE - seg_off (the raw segment...

EUVD-2026-76280

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...

CVE-2026-80957 dm-pcache: detect a cycle in the last-kset chain during replay

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cachereplay follows the on-media last-kset chain by nextcachesegid with no condresched. A forged chain that points back into a segment it has already visited makes th...

CVE-2026-80958

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...

CVE-2026-80956

CVE-2026-80956 affects the Linux kernel's dm-pcache (device mapper persistent cache) subsystem. The root cause is a bounds mismatch: get_cache_segment() scans the segment map up to cache->n_segs (the physical device segment count), while cache_segs_init() only initializes the first cache_info-...

EUVD-2026-76279

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-80956

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-80956 dm-pcache: only hand out initialized cache segments

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-80956 dm-pcache: only hand out initialized cache segments

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-80955

CVE-2026-80955 is a use-after-free vulnerability in the Linux kernel's dm-pcache module, within the kset_replay() function. When a key's segment generation (key->seg_gen) is stale, cache_key_put(key) frees the key memory, but key->cache_pos.cache_seg is subsequently accessed as an argument ...