{"id":"CVE-2026-80955","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-80955","summary":"dm-pcache: fix use-after-free and invalid seg operations in kset_replay()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: fix use-after-free and invalid seg operations in kset_replay()\n\nIn kset_replay, when key->seg_gen is stale (key->seg_gen <\nkey->cache_pos.cache_seg->gen), cache_key_put(key) is called but then\nkey->cache_pos.cache_seg is accessed as the argument to cache_seg_get().\nThis is a use-after-free on the freed key memory. Although mempool\nrecycled memory is not immediately reclaimed or overwritten in practice,\nthis is still a potential UAF bug.\n\nAdditionally, for expired invalid keys, setting the cache->seg_map bit\nand calling cache_seg_get() is unreasonable since the corresponding\nsegment data is no longer valid.\n\nFix both issues by moving cache_seg_get() and __set_bit() after the\ngen check, so they only execute for valid keys, and using continue to\nskip invalid keys.","published":"2026-09-11T19:42:23.838Z","modified":"2026-09-14T03:45:54.207330154Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.18.50"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1894fc7a3bab90143dcd26ef8ee27040ef4a7501"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c2e894eac398b258f12fdec73ed6ba081047f7b3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f39a3e9cc5946473e16d6f5071b2ee0216c56d06"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80955.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80955"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T03:45:54.207330154Z"}}