EUVD-2026-76281
GHSA-hh69-ghmv-95j7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local vector with low privileges matches dm-pcache access model; C:H for control-area disclosure, A:H for potential kernel panic, no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: clamp the tail kset read to the segment data region
The tail-kset read in cache_replay(), the writeback worker and the GC worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment size rather than the data region. A tail near the segment end reads past the segment data into the following control area.
Clamp the read to cache_seg_remain(), the data region.
AnalysisAI
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target kernel be built with dm-pcache support (CONFIG_DM_PCACHE) and that an active dm-pcache device be configured and mounted on the system - this is a non-default, operator-configured storage topology. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H scores 7.1 (High) and is well-grounded: exploitation requires local access with low privileges, which is realistic for any multi-tenant or shared-compute environment using dm-pcache. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Linux kernel 6.18.50 or 7.2.4 (stable branches) or any 7.3-rc1+ snapshot; the fix commits are available at https://git.kernel.org/stable/c/2cd9776fe3f2d88ec22c36d3c8ba09fbf9d5500c, https://git.kernel.org/stable/c/1ab55354368d071ebaee4d8c82313955eab65a04, and https://git.kernel.org/stable/c/becf07e2b0053027495ecd671b1f82fb2e615f68. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all systems running affected Linux kernel versions (6.18.x before 6.18.50 or 7.2.x before 7.2.4) to assess organizational exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today