Executive brief
Linux's dm-pcache device-mapper target is a storage caching module that accelerates I/O performance. An attacker with administrative privileges can craft malicious cache device metadata to specify an out-of-range segment ID, causing the kernel to read from and write to arbitrary memory locations. This results in potential system crashes, data corruption, or privilege escalation.
Technical details
The vulnerability is an out-of-bounds read and write in the dm-pcache module's segment ID validation. Functions cache_pos_decode(), cache_key_decode(), and workers (GC, writeback, cache replay) read a cache segment ID from device metadata and use it to index the cache->segments[] array without bounds checking. The metadata is only CRC-protected with a fixed public seed, allowing an attacker with CAP_SYS_ADMIN (required to load the dm-pcache target) to supply arbitrary ID values. An out-of-range ID dereferencing an invalid pointer enables both out-of-bounds memory reads and writes. The fix adds cache_seg_id_valid() validation before each array indexing operation, returning -EIO if the ID exceeds cache->cache_info.n_segs. No authentication or user interaction is required beyond the initial privileged table load.
Affected products
- Linux Linux kernel affected versions prior to commit 90c990a68460d7b5720e5634cf650eccdf0f4098
Timeline
- 2026-09-17: disclosed: CVE-2026-93201 published on NVD
- 2026-07-17: patched: Upstream fix committed (90c990a68460d7b5720e5634cf650eccdf0f4098)