Executive brief
Linux kernel's dm-pcache (persistent cache target) contains a flaw in how it validates persisted cache metadata at load time. An attacker with the ability to craft a malicious cache image can create a circular reference in the dirty tail chain, causing the cache writeback worker to loop indefinitely with no delay, consuming CPU resources and preventing normal cache operations.
Technical details
The vulnerability is a denial-of-service condition in dm-pcache's dirty_tail chain parsing. The dirty_tail chain is decoded from the on-media cache device independently of the key_tail chain, and is protected only by a weak CRC32C with a fixed seed. A crafted malicious cache image can structure the dirty_tail chain to form an infinite loop, causing cache_writeback_fn() to continuously re-arm itself with no delay. The fix adds validation at cache load time (cache_verify_dirty_tail) that walks the entire dirty_tail chain and rejects it if traversal exceeds n_segs hops without terminating, mirroring the bounds-checking already applied to key_tail by cache_replay().
Affected products
- Linux Linux kernel versions with dm-pcache (persistent cache target)
Timeline
- 2026-09-17: disclosed: CVE-2026-93198 published
- 2026-07-17: patched: Upstream fix commit 58d620ee9e01d4bdbceaf2ae1450d307a2a9d58b by Bryam Vargas and Mikulas Patocka
- 2026-09-14: patched: Stable kernel backport commit 4822a030929e0e77aa380722dc42e3e4c9edd346