CVE-2026-80956: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-80956DEBIAN-CVE-2026-80956
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-80956 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.1% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.21%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11805-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments get_cache_segment() scans the segment map up to cache->n_segs, the physical device segment count, but cache_segs_init() only initializes the first cache_info->n_segs segments. A crafted image with cache_info->n_segs smaller than the device count leaves the remaining pcache_cache_segment structs zeroed (segment.data == NULL), and the allocator can hand one to cache_kset_close(), which writes through the returned segment's data pointer with no NULL check. Bound the allocator's search to cache_info->n_segs so only initialized segments are ever returned. A conforming cache sets n_segs equal to the device segment count, so this rejects nothing legitimate.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

+0.01 pp

From 0.20% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu118 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 7.2.6-1
Linux1 product
  • linux≥ 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0, < 83e3116283ed2c6a6a1fa662862a4b4d7d2701a2 | ≥ 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0, < 692037ae1a7cfacc2f0c22c6e034c1dfee0e553f | ≥ 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0, < 2df0fc042e299bae3c0f60ea5cd2af9285658e9f | 6.18

3 vendors · 120 products

References

7 links