CVE-2026-80718

Received Received - Intake

Memory Corruption in Linux Kernel

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed. When nr_units > 1, the function writes beyond chunk->populated. Fix it by using chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly") introduced the bitmap overflow issue. Later, commit b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the accounting issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80718

EUVD

EUVD-2026-67453

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bitmap overflow and incorrect accounting in the pcpu_create_chunk() function. The issue occurs when nr_units is greater than 1, causing the function to write beyond the allocated chunk->populated bitmap, which is sized for a single unit. This happens because the function incorrectly uses nr_pages (total allocation) instead of chunk->nr_pages (actual unit pages) for bitmap operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's percpu memory management and does not have direct network or system detection commands. It requires kernel source code analysis or patch verification to confirm exposure. Check if your kernel version includes the vulnerable commits a63d4ac4ab609 or b539b87fed37f.

Impact Analysis

This vulnerability could lead to memory corruption or undefined behavior in the Linux kernel's percpu memory management. It may cause system instability, crashes, or potential privilege escalation if exploited. Systems using affected kernel versions could experience data corruption or unexpected failures in memory allocation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory management issue in the Linux kernel's percpu subsystem. Compliance impacts would depend on system-specific implementations and data handling practices rather than this technical flaw.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80718. The vulnerability is resolved in the commit a63d4ac4ab609 and related fixes.

Hi! I’m here to help you understand CVE-2026-80718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70