EUVD-2026-76285
GHSA-mv2p-grx7-v5rf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CAP_SYS_ADMIN is required to load dm tables, placing privilege at PR:H; all other parameters follow the description directly.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate geometry fields from on-disk cache_info
cache_segs_init() iterates cache_info->n_segs times indexing cache->segments[], which is sized to the cache device geometry, and get_seg_id() takes each segment id from the on-media cache_info and the per-segment next_seg link. Both come from cache device metadata that is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls them: an oversized n_segs or an out-of-range id drives an out-of-bounds access of cache->segments[] and a wild CACHE_DEV_SEGMENT() pointer into the device mapping -- an out-of-bounds read and write from on-disk data.
Reject an n_segs that exceeds the device segment count and a segment id that is out of range before either is used. Valid metadata is unaffected.
AnalysisAI
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access with CAP_SYS_ADMIN capability on the target system - this is explicitly stated in the description as the privilege needed to load a dm table; (2) the dm-pcache kernel module to be loaded or loadable on the target; (3) the ability to supply or substitute a block device (real or virtual) as the cache device argument in a dm-pcache table load, with attacker-controlled metadata content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects local kernel memory corruption with full C:H/I:H/A:H impact, but the PR:L assignment may be optimistic: the description explicitly states that CAP_SYS_ADMIN is required to load a dm table, placing the effective privilege requirement closer to PR:H and reducing the realistic score to approximately 6.7. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Linux 6.18.50, 7.2.4, or later (7.3-rc1+), which introduce explicit range validation for n_segs against the computed device segment count and validate each segment ID before use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems to identify which have device mapper persistent cache (dm-pcache) active and which users possess CAP_SYS_ADMIN capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today