Linux Kernel CVE-2026-93201

Requires CAP_SYS_ADMIN to load a device-mapper table referencing an attacker-supplied dm-pcache cache device carrying forged metadata; because the cache metadata is only CRC-protected with a fixed, publicly-known seed, the attacker can freely control the seg_id field and still pass integrity checks. Exploitation is local only (AV:L) and gated on this administrative capability, so it does not apply to unprivileged users or default remote access. Valid, driver-created cache images set cache_info.n_segs equal to seg_num and are unaffected; only a hand-forged image with an out-of-range or windowed seg_id triggers the wild-pointer deref.

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk because the description makes the true privilege bar explicit: the malicious cache device metadata is only trusted by whoever supplies the cache device on a device-mapper table load, an operation requiring CAP_SYS_ADMIN. That is effectively root-equivalent, so the honest privilege metric is PR:H, not PR:L - an actor who can load a dm table already holds sweeping kernel-affecting capability, making the marginal escalation modest. The flaw is nonetheless a genuine memory-corruption primitive: an out-of-range seg_id read from CRC-only-protected (fixed public seed) on-disk metadata forms a wild pcache_cache_segment pointer that is both dereferenced and written through, i.e. a real OOB read AND write driven by attacker-controlled disk data, so the 'Buffer Overflow' tag is accurate here (unlike many sibling dm/driver CVEs). No EPSS score, KEV listing, or public POC is provided; exploitation status is therefore no public exploit identified at time of analysis. Net: this is a legitimate but privilege-gated local corruption bug in a brand-new driver, not a widespread priority - realistic score closer to 5.0-5.5 once PR:H is applied.

A local actor with CAP_SYS_ADMIN (e.g. a host administrator, or a container granted that capability) crafts a dm-pcache cache device whose metadata carries a forged segment id and a CRC computed with the known fixed public seed. When the device-mapper table is loaded and the cache is decoded/replayed or processed by the writeback or GC worker, the kernel indexes cache->segments[] with the out-of-range id, dereferencing and writing through a wild pointer for OOB read/write and kernel memory corruption. No public exploit code is identified at the time of analysis.