CVE-2026-80685mm/util: don't read __page_2 for order-1 folios in snapshot_page()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap). Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 21, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 31a31da8a6187f1e5448ec73222e01d7d3fed4aa before 9668ffe0e2a5e2399dce281620198a2e415871fc; from 31a31da8a6187f1e5448ec73222e01d7d3fed4aa before c649324571206a30949765320b91ccdb4c1722dc; from 31a31da8a6187f1e5448ec73222e01d7d3fed4aa before 7441d6348c70738e9ed307510db171c7a9b3f4bf; 4117738bd42c8ab58090729daf0f8472a936f662; from 6.12.111 before 6.13 | CNA record |
References
- https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc
- https://git.kernel.org/stable/c/c649324571206a30949765320b91ccdb4c1722dc
- https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.