The Linux kernel's dm-pcache component had a flaw in get_cache_segment() where it scanned the segment map up to the physical device segment count (cache->n_segs), but cache_segs_init() only initialized the first cache_info->n_segs segments. If cache_info->n_segs was smaller than the device count, the remaining cache segment structures were zeroed with segment.data == NULL. The allocator could return one of these uninitialized segments to cache_kset_close(), which writes through the segment's data pointer without checking for NULL, leading to potential memory corruption. The patch restricts the allocator's search to cache_info->n_segs, ensuring only initialized segments are returned. Legitimate caches set n_segs equal to the device segment count, so this fix does not reject valid segments.

This vulnerability could lead to memory corruption or kernel instability due to writes through NULL or uninitialized pointers in the dm-pcache subsystem. There is no information about active exploitation in the wild. The impact is limited to systems using dm-pcache with a crafted cache image that triggers the condition.

A fix has been applied to the Linux kernel to bound the allocator's search to only initialized cache segments, preventing the use of uninitialized segments. Users should update their Linux kernel to a version including this fix once available. Patch status is not explicitly confirmed in the input; verify with the official Linux kernel advisories for the exact fixed versions and apply updates accordingly.