CVE intelligence

CVE-2026-80955

Vulnerability intelligence

Published Sep 11, 2026Sources checked Nov 3, 2026

7.8HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-80955 and is rated High severity with a CVSS score of 7.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-80955?

In the Linux kernel, the following vulnerability has been resolved:

dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->cache_pos.cache_seg is accessed as the argument to cache_seg_get(). This is a use-after-free on the freed key memory.

Although mempool recycled memory is not immediately reclaimed or overwritten in practice, this is still a potential UAF bug.

Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable since the corresponding segment data is no longer valid.

Fix both issues by moving cache_seg_get() and __set_bit() after the gen check, so they only execute for valid keys, and using continue to skip invalid keys.

Source: NVD