CVE-2026-80685

mm/util: don't read __page_2 for order-1 folios in snapshot_page()

CVSS 3.1 7.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-80685

Published

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap). Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-80685

Published

Linux

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "mm/util.c"
                    ],
                    "versions": [
                        {
                            "version": "31a31da8a6187f1e5448ec73222e01d7d3fed4aa",
                            "lessThan": "9668ffe0e2a5e2399dce281620198a2e415871fc",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "31a31da8a6187f1e5448ec73222e01d7d3fed4aa",
                            "lessThan": "c649324571206a30949765320b91ccdb4c1722dc",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "31a31da8a6187f1e5448ec73222e01d7d3fed4aa",
                            "lessThan": "7441d6348c70738e9ed307510db171c7a9b3f4bf",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "4117738bd42c8ab58090729daf0f8472a936f662",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "6.12.111",
                            "lessThan": "6.13",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Linux

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "mm/util.c"
                    ],
                    "versions": [
                        {
                            "version": "6.15",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.15",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.44",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1.8",
                            "lessThanOrEqual": "7.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON