Executive brief
The Linux kernel's dm-pcache (persistent cache) module contains a denial-of-service vulnerability in its cache replay mechanism. A crafted or corrupted cache structure with a circular reference chain can cause the kernel to enter an infinite loop, consuming CPU resources and potentially crashing the system or preventing legitimate storage operations.
Technical details
The vulnerability exists in the cache_replay() function within drivers/md/dm-pcache/cache_key.c. The function iterates through a chain of cache segments by following next_cache_seg_id pointers without detecting cycles. An attacker who can craft or corrupt the on-media cache structure can create a chain that points back to a previously-visited segment, causing the loop to iterate indefinitely. The fix adds a hop counter (last_hops) that caps traversal at cache->n_segs, ensuring no valid chain exceeds the total number of segments. This is a local attack vector requiring access to the storage backing the persistent cache.
Affected products
- Linux Linux kernel affected versions prior to patch commit 16c3b3a326e70f246a605b3dc27b7f83ba4743e3
Timeline
- 2026-09-11: disclosed: CVE-2026-80957 published
- 2026-07-17: patched: Fix committed by Bryam Vargas, merged by Mikulas Patocka