Executive brief
The Linux kernel's device-mapper persistent cache (dm-pcache) module contains a buffer over-read vulnerability in its cache replay, writeback, and garbage collection operations. An attacker with local access could read sensitive data from memory regions adjacent to the cache segment data, potentially exposing cached information or kernel memory contents.
Technical details
The vulnerability is a buffer over-read in the dm-pcache module's key set read operations. In cache_replay(), the writeback worker, and the garbage collection worker, the code incorrectly bounds the read length using PCACHE_SEG_SIZE - seg_off (raw segment size) instead of cache_seg_remain() (actual data region size). When a tail structure is positioned near a segment boundary, this causes reads to extend past the segment data into the following control area. An attacker with local access to a system using dm-pcache could trigger this condition to read out-of-bounds memory. A patch has been merged upstream (commit becf07e2b0053027495ecd671b1f82fb2e615f68) replacing the incorrect calculation with a call to cache_seg_remain() in three files: cache_gc.c, cache_key.c, and cache_writeback.c.
Affected products
- Linux Linux kernel affected versions include dm-pcache module (since introduction at commit 1d57628ff95b)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched