The Linux kernel's dm-pcache module previously did not validate the on-media seg_num value against the actual cache device size. Since seg_num is read from a crc32c-only superblock controlled by the cache device supplier (with CAP_SYS_ADMIN privileges), an attacker with administrative rights could supply a seg_num larger than the device can hold. This causes the CACHE_DEV_SEGMENT() macro to resolve to kernel memory beyond the mapped device, leading to an out-of-bounds write of approximately 12 KiB into the kernel heap during cache segment initialization. The fix involves rejecting seg_num values that are zero, exceed the device size, or are larger than PCACHE_CACHE_SEGS_MAX before use.

An attacker with CAP_SYS_ADMIN privileges who supplies a malicious cache device can trigger an out-of-bounds write in kernel memory during dm-pcache initialization. This memory corruption could potentially lead to system instability or privilege escalation, depending on exploitation context. However, exploitation requires administrative capability to supply the cache device, limiting the attack surface.

The vulnerability has been resolved by adding validation checks to reject invalid seg_num values before they are used. Users should apply the official Linux kernel update that includes this fix. No additional mitigation is required once the patch is applied.