The vulnerability in the Linux kernel's dm-pcache arises because cache_pos_decode() uses persisted key_tail and dirty_tail segment offsets from the cache device without properly bounding them. If a segment offset equal to or greater than the segment's data size is supplied by an entity with CAP_SYS_ADMIN privileges, it can cause a read beyond the segment data boundary. The patch bounds the persisted tail-position offset by rejecting any decoded segment offset that is not below the segment data size, preventing out-of-bounds reads.

An attacker with CAP_SYS_ADMIN privileges on the system could exploit this vulnerability to cause out-of-bounds reads in the kernel memory. This could potentially lead to information disclosure or system instability depending on the context of the read. However, exploitation requires elevated privileges (CAP_SYS_ADMIN), limiting the scope of impact.

A fix has been applied to the Linux kernel to bound the persisted tail-position offset in dm-pcache, rejecting invalid segment offsets. Users should update their Linux kernel to a version that includes this fix. Since no specific patch links or versions are provided, check the official Linux kernel advisories or vendor updates for the patched kernel versions.