Out-of-bounds read in Linux kernel - CVE-2026-80959

Vulnerability details

The vulnerability allows a local privileged user to read past the segment data.

The vulnerability exists due to an out-of-bounds read in cache_pos_decode() in dm-pcache when decoding persisted key_tail and dirty_tail segment offsets from a supplied cache device. A local privileged user can supply a cache device containing a segment offset at or beyond the segment data size to read past the segment data.

Affected software

How to mitigate CVE-2026-80959

External References

• https://git.kernel.org/stable/c/8bf7a06ca3c1611809725f58cfd573f2ffbda75f
• https://git.kernel.org/stable/c/d1898576090a10d2ac2715218a652e78fb65a6b0
• https://git.kernel.org/stable/c/ffd9a214a94f9928e54856f42b1cc3e33fb10e36

Related Security Bulletins

• Out-of-bounds read in Linux kernel md dm-pcache driver