Riskcovery

CVE-2026-80685

mm/util: don't read __page_2 for order-1 folios in snapshot_page()

State
Published
Severity
7.1 High
Published
Aug 28, 2026
Updated
Sep 21, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/util: don't read __page_2 for order-1 folios in snapshot_page()

snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2.

If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault.

During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap).

Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 31a31da8a6187f1e5448ec73222e01d7d3fed4aa to before 9668ffe0e2a5e2399dce281620198a2e415871fcAffected
  • 31a31da8a6187f1e5448ec73222e01d7d3fed4aa to before c649324571206a30949765320b91ccdb4c1722dcAffected
  • 31a31da8a6187f1e5448ec73222e01d7d3fed4aa to before 7441d6348c70738e9ed307510db171c7a9b3f4bfAffected
  • 4117738bd42c8ab58090729daf0f8472a936f662Affected
  • 6.12.111 to before 6.13Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.18.44 through 6.18.*Not affected
  • 7.1.8 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.