EUVD-2026-76278
GHSA-vjx8-9mvv-9939
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel UAF reachable by low-privileged users with dm-pcache access; no scope change; full C/I/A impact from kernel heap corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory. Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug.
Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid.
Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.
AnalysisAI
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a local user account with at least low-privileged access to the system (PR:L per CVSS); (2) the target system must have the dm-pcache kernel module loaded and an active dm-pcache device-mapper target configured - this is a non-default configuration specific to tiered storage or caching setups; (3) the attacker must be able to trigger the kset_replay() code path, which processes key replay for the persistent cache. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitation requiring low privileges, consistent with a kernel subsystem UAF reachable by any process with sufficient permissions to interact with dm-pcache devices. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux kernel 6.18.50, 7.2.4, or apply the 7.3-rc1 mainline fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, contact your Linux vendor for kernel versions affected by this dm-pcache use-after-free flaw and cross-reference your inventory to identify vulnerable systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today