CVE-2026-80959 dm-pcache: bound the persisted tail-position offset

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

CVE-2026-80959

CVE-2026-80959 affects the Linux kernel's dm-pcache (device-mapper persistent cache) component. The root cause is in cache_pos_decode() , which uses persisted key_tail and dirty_tail seg_off values to address data within a cache segment. A seg_off at or past the segment data_size , controllable b...