CVE-2026-93201— dm-pcache: validate seg_id fields from persistent memory
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已被修复： dm-pcache：验证来自持久内存的 seg_id 字段 、 以及 的最后 kset 分支、writeback 工作线程和 GC 工作线程，会从缓存设备元数据中获取一个缓存段 ID，并直接使用该 ID 作为索引访问 数组，而并未先将其与 进行边界检查。该元数据仅使用固定的公开种子进行 CRC 保护，因此，在加载表格（table load）时提供缓存设备的一方（拥有 权限）可以控制该 ID。如果提供一个超出范围的值，将会形成一个野指针（wild pointer）指向 ，该
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93201
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
dm-pcache: validate seg_id fields from persistent memory
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: validate seg_id fields from persistent memory
cache_pos_decode(), cache_key_decode() and the last-kset branches of
cache_replay(), the writeback worker and the GC worker take a cache
segment id from the cache device metadata and index cache->segments[]
with it without checking it against cache->n_segs. That metadata is only
CRC-protected with a fixed public seed, so whoever supplies the cache
device on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range
value forms a wild pcache_cache_segment pointer that is dereferenced and
written through -- an out-of-bounds read and write driven by on-disk data.
Add cache_seg_id_valid() and reject an out-of-range id at each decode
site, failing the operation with -EIO instead of indexing past the array.
Bound the id against the initialized-segment count (cache_info.n_segs)
rather than the physical device total. A forged cache_info.n_segs below
seg_num otherwise leaves segments[cache_info.n_segs..seg_num) as zeroed
structs whose data pointer is NULL, so a forged id in that window would
still be dereferenced. A later patch guarantees cache_info.n_segs <=
seg_num, and a driver-created cache sets the two equal, so valid images
are unaffected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93201
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93201
请登录查看更多情报信息。
Other References for CVE-2026-93201 (2)
Same Patch Batch · Linux · 2026-09-17 · 602 CVEs total
| CVE-2026-90255 | Bluetooth: hci_conn: fix the SCO setup context lifetime | |
| CVE-2026-90238 | media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path | |
| CVE-2026-90240 | iommu/vt-d: Flush context cache with correct SID when tearing down aliases | |
| CVE-2026-90239 | media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() | |
| CVE-2026-90241 | iommu/vt-d: Tear down scalable-mode context on probe failure | |
| CVE-2026-90243 | iommu/vt-d: Clear Present bit before tearing down copied context entry | |
| CVE-2026-90242 | iommu/vt-d: Fix iopf_refcount leak on RID domain replacement | |
| CVE-2026-90244 | iommu/dma: Restore locking around msi_page_list | |
| CVE-2026-90245 | fbdev: kyro: Validate overlay viewport coordinates | |
| CVE-2026-90246 | apparmor: fix integer overflow in verify_tags() bounds check | |
| CVE-2026-90247 | bpf: Fix mmap_lock leak in irq_work path | |
| CVE-2026-90248 | net/sched: cls_api: fix teardown of an adopted proto on insert-race loss | |
| CVE-2026-90249 | iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes | |
| CVE-2026-90250 | bpf, cgroup: Fix storage null-ptr-deref after replacing prog | |
| CVE-2026-90251 | Bluetooth: MSFT: validate evt_prefix_len against the response length | |
| CVE-2026-90253 | Bluetooth: MGMT: free the mesh send cancel command when it is cancelled | |
| CVE-2026-90252 | Bluetooth: MGMT: free the HCI command when it is cancelled | |
| CVE-2026-90254 | Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths | |
| CVE-2026-90256 | Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind | |
| CVE-2026-90268 | scsi: sd: Fix error handling in sd_probe() after large pool creation failure |
Showing top 20 of 602 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-93203
batman-adv: bla: avoid CRC corruption due to parallel claim -
CVE-2026-93204
batman-adv: dat: atomically update mac addresses -
CVE-2026-93202
i3c: master: Fix recursive locking during device registratio -
CVE-2026-93200
i3c: master: Fix use-after-free of master->this -
CVE-2026-93199
i3c: master: Do not treat master device as a duplicate targe
Same vendor: Linux
-
CVE-2026-93203
batman-adv: bla: avoid CRC corruption due to parallel claim -
CVE-2026-93204
batman-adv: dat: atomically update mac addresses -
CVE-2026-93202
i3c: master: Fix recursive locking during device registratio -
CVE-2026-93200
i3c: master: Fix use-after-free of master->this -
CVE-2026-93199
i3c: master: Do not treat master device as a duplicate targe
V. Comments for CVE-2026-93201
No comments yet