CVE-2026-80961

A flaw was found in the dm-pcache component of the Linux kernel. A local attacker with CAP_SYS_ADMIN capabilities could exploit unbounded fields decoded from the cache device. This could lead to an out-of-bounds read, potentially disclosing sensitive information from adjacent persistent memory to user space.

A flaw was found in the dm-pcache component of the Linux kernel, which Red Hat rates as having Moderate impact. Two fields decoded from the cache device, the kset key_num and a key's intra-segment offset and length, are consumed without bounds validation. A crafted cache device whose kset key_num exceeds the PCACHE_KSET_KEYS_MAX buffer causes an out-of-bounds read before the CRC comparison, and a key whose offset plus length runs past its segment boundary is replayed into the cache tree, so the data CRC check and subsequent cache read hits copy adjacent persistent memory into the caller's bio. The consequence is an out-of-bounds read that can disclose sensitive information from adjacent persistent memory to user space. The attack vector is local: exploitation requires CAP_SYS_ADMIN privileges, because the attacker must be able to supply the crafted cache device, and the CRC seed used in metadata validation is public. Red Hat assesses this flaw as CVSS 5.5 (Moderate), while the upstream CVE record assigns CVSS 7.8 (Important); the difference reflects Red Hat's evaluation of the impact for its supported products given the high privileges required to supply the malformed cache device. All Red Hat Enterprise Linux and Red Hat OpenShift Container Platform streams listed for this flaw are not affected because the vulnerable dm-pcache code is not present in the shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.