A critical out-of-bounds read vulnerability in the Linux kernel dm-pcache component permits local privilege escalation and memory corruption by a privileged attacker.

The flaw resides in the cache_pos_decode function, which fails to properly validate the persisted tail-position offset against segment data size. An attacker possessing CAP_SYS_ADMIN capabilities can supply a malicious device to trigger an out-of-bounds read, potentially leading to system compromise.

The vulnerability carries a CVSS score of 7.8, reflecting its high impact on confidentiality, integrity, and availability. While it requires elevated local privileges, successful exploitation allows an attacker to manipulate kernel memory, which could lead to a full system compromise, data theft, or persistent denial of service.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected segmentation faults that may indicate attempts to trigger memory corruption within the dm-pcache module.

Compensating Controls: Restrict the ability of untrusted users to mount or interact with cache devices, and ensure that the CAP_SYS_ADMIN capability is strictly limited to authorized administrative accounts.

Public Exploit Available: No

Given the severity of potential kernel-level memory corruption, organizations should prioritize patching their Linux distributions as soon as the updated kernels become available in their respective package repositories. Maintain a strict policy regarding the assignment of administrative capabilities to minimize the attack surface for this and similar local privilege escalation vulnerabilities.