Executive brief
The Linux kernel's dm-pcache (persistent cache) module can be exploited via a crafted cache image with mismatched segment counts, allowing an attacker to trigger a NULL pointer dereference and kernel crash. This affects systems using the device-mapper persistent cache feature, potentially causing denial of service or system instability.
Technical details
The vulnerability exists in the dm-pcache segment allocator (get_cache_segment function). The allocator scans up to the physical device segment count (cache->n_segs) when searching for available segments, but the cache initialization routine (cache_segs_init) only initializes the first cache_info->n_segs segments. A crafted image with cache_info->n_segs smaller than the device segment count leaves remaining pcache_cache_segment structures with NULL data pointers. The allocator can then hand an uninitialized segment to cache_kset_close(), which dereferences the data pointer without a NULL check, causing a kernel crash. The fix bounds the allocator's search to cache_info->n_segs, ensuring only initialized segments are returned. Attack requires local access to provide a crafted image and mount it via the persistent cache target.
Affected products
- Linux Linux kernel all versions with dm-pcache module (5.11+)
Timeline
- 2026-09-11: disclosed
- 2026-07-17: patched: Fix commit 2df0fc042e299bae3c0f60ea5cd2af9285658e9f