CVE-2026-80685

mm/util: don't read __page_2 for order-1 folios in snapshot_page()

HIGH
7.1
CVSS Score
Published: August 28, 2026 at 06:52 AM UTC
Updated: September 21, 2026 at 02:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap). Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 6.12.1116.12.111 ≤ v < 6.136.15 ≤ v < 6.18.446.15 ≤ v < 7.1.86.15 ≤ v < 7.231a31da8a6187f1e5448ec73222e01d7d3fed4aa4117738bd42c8ab58090729daf0f8472a936f6626.12.1116.15
Vendor states this is fixed in 7441d6348c70738e9ed307510db171c7a9b3f4bf (fixed)
Vendor states this is fixed in 9668ffe0e2a5e2399dce281620198a2e415871fc (fixed)
Vendor states this is fixed in c649324571206a30949765320b91ccdb4c1722dc (fixed)
Affected range stops below 6.13, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.18.44 (unaffected)
Vendor states this is fixed in 7.1.8 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

7.1HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card