CVE-2026-80963

dm-stats: fix a crash if allocation of per-cpu data fails

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-stats: fix a crash if allocation of per-cpu data fails

If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_stat_free. dm_stat_free does "for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);", which crashes with NULL pointer dereference if s->stat_percpu[cpu] is NULL.

This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before using it.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before e45f0b0c41139810ff395ba2f3cfca1460a5b8a6Affected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 9805d87d0e26c68ee69da3928e665214d2e2851aAffected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 564d17573ef643c13cf6e9015124a205fa65e704Affected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 389a50d094e13724f5f45e6d9d6ef734c98ba291Affected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before c3f211b7a277dd404b4e7d23095be964b5b46a27Affected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 74210fa072960a18bb0eead487585452af722e4fAffected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 0c8f7870ed3ebd512f090d7714cc2c556b9e5c75Affected fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before cc87e26d9cce22061dc21e51e11afef29dbbc36aAffected
LinuxLinux	3.12Affected before 3.12Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before e45f0b0c41139810ff395ba2f3cfca1460a5b8a6Affected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 9805d87d0e26c68ee69da3928e665214d2e2851aAffected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 564d17573ef643c13cf6e9015124a205fa65e704Affected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 389a50d094e13724f5f45e6d9d6ef734c98ba291Affected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before c3f211b7a277dd404b4e7d23095be964b5b46a27Affected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 74210fa072960a18bb0eead487585452af722e4fAffected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before 0c8f7870ed3ebd512f090d7714cc2c556b9e5c75Affected
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a to before cc87e26d9cce22061dc21e51e11afef29dbbc36aAffected

LinuxLinux

3.12Affected
before 3.12Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.