The Linux kernel's dm-pcache module had a vulnerability where the cache_segs_init() function iterates over cache segments based on the n_segs field from on-disk cache_info metadata, and get_seg_id() uses segment IDs from the same metadata. Both n_segs and segment IDs come from cache device metadata protected only by a CRC with a fixed public seed, allowing a user with CAP_SYS_ADMIN to supply crafted metadata that causes out-of-bounds access to the cache->segments[] array. This results in out-of-bounds reads and writes from on-disk data. The fix involves validating that n_segs does not exceed the device segment count and that segment IDs are within range before usage, preventing out-of-bounds access.

An attacker with CAP_SYS_ADMIN privileges who can supply the cache device on a table load can cause out-of-bounds read and write operations in kernel memory by providing oversized or out-of-range geometry fields in the cache_info metadata. This could lead to memory corruption or kernel instability. However, this requires administrative privileges and crafted metadata input.

A fix has been implemented that validates the n_segs field and segment IDs from on-disk cache_info metadata before use, rejecting invalid values to prevent out-of-bounds access. Users should apply the updated Linux kernel version containing this fix. No additional mitigation is required for valid metadata.