Out-of-bounds write in Linux kernel - CVE-2026-80960

Vulnerability details

The vulnerability allows a local privileged user to perform an out-of-bounds write to kernel heap memory.

The vulnerability exists due to an out-of-bounds write in the dm-pcache cache device initialization code when loading a table with a cache device containing a forged seg_num value. A local privileged user can supply a cache device with a crafted superblock to perform an out-of-bounds write to kernel heap memory.

Affected software

How to mitigate CVE-2026-80960

External References

• https://git.kernel.org/stable/c/62d92e45abe9e087370f9fc5d876b95673aced34
• https://git.kernel.org/stable/c/91b93fe5cf4d62d5ecc642a6c8f15a3c11b00e3c
• https://git.kernel.org/stable/c/e889c0ee81165fc90aad2979b51f930f77895703

Related Security Bulletins

• Out-of-bounds write in Linux kernel md dm-pcache driver