The Linux kernel's dm-pcache module had a vulnerability where two fields decoded from the cache device metadata—key_num and intra-segment offset/length—were not properly validated. The key_num could exceed the PCACHE_KSET_KEYS_MAX buffer, causing reads past the buffer end before CRC comparison. Additionally, the intra-segment offset and length were used verbatim, allowing keys that run past their segment to be replayed into the cache tree, causing out-of-bounds reads that leak adjacent persistent memory into user space. Both fields are controlled by entities with CAP_SYS_ADMIN privileges. The fix involved adding the kset_onmedia_valid() function to bound key_num before any read and rejecting keys whose offset plus length exceed the segment data size.

This vulnerability allows a privileged user (CAP_SYS_ADMIN) supplying the cache device to cause out-of-bounds reads in the kernel, potentially leaking adjacent persistent memory contents to user space. This could lead to unauthorized disclosure of sensitive information. The issue does not affect valid metadata and requires control over the cache device metadata.

A fix has been implemented in the Linux kernel to validate the kset key_num and intra-segment bounds before processing. Users should update to a kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigations are indicated.