GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80685 (GCVE-0-2026-80685)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:52 – Updated: 2026-08-29 06:22
VLAI
Title
mm/util: don't read __page_2 for order-1 folios in snapshot_page()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap). Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 31a31da8a6187f1e5448ec73222e01d7d3fed4aa , < 9668ffe0e2a5e2399dce281620198a2e415871fc (git)
Affected: 31a31da8a6187f1e5448ec73222e01d7d3fed4aa , < c649324571206a30949765320b91ccdb4c1722dc (git)
Affected: 31a31da8a6187f1e5448ec73222e01d7d3fed4aa , < 7441d6348c70738e9ed307510db171c7a9b3f4bf (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9668ffe0e2a5e2399dce281620198a2e415871fc",
              "status": "affected",
              "version": "31a31da8a6187f1e5448ec73222e01d7d3fed4aa",
              "versionType": "git"
            },
            {
              "lessThan": "c649324571206a30949765320b91ccdb4c1722dc",
              "status": "affected",
              "version": "31a31da8a6187f1e5448ec73222e01d7d3fed4aa",
              "versionType": "git"
            },
            {
              "lessThan": "7441d6348c70738e9ed307510db171c7a9b3f4bf",
              "status": "affected",
              "version": "31a31da8a6187f1e5448ec73222e01d7d3fed4aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/util: don\u0027t read __page_2 for order-1 folios in snapshot_page()\n\nsnapshot_page() currently reads __page_2 after checking nr_pages \u003e 1, but\nit should only do so when nr_pages \u003e 2.\n\nIf an order-1 folio is allocated at the end of a vmemmap section,\n__page_2 will not exist and reading it will cause a fault.\n\nDuring DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed\non the page isolation path while reading an order-1 folio\u0027s __page_2 from\nan adjacent absent section (unmapped vmemmap).\n\nFix this to avoid reading memmap that doesn\u0027t exist (e.g., a vmemmap\nhole)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable via local read(2) on /proc/kpageflags or /proc/kpagecount (kpage_read\u2192stable_page_flags/get_kpage_count\u2192snapshot_page); the reported production crash also occurs on the memory-hotplug page-isolation dump_page path during offline_pages/DLPAR, with no network or physical-bus entry point.\nAC:L - A container/user-namespace root can sequentially scan PFNs via /proc/kpageflags until snapshot_page hits an order-1 folio at a vmemmap section boundary; on large SPARSEMEM_VMEMMAP systems such folios exist naturally (22 TB ppc64le LPAR oops) without races or attacker-uncontrollable timing.\nPR:L - /proc/kpage* is mode 0400 (root-only); exploitation needs only namespace/container root or CAP_SYS_ADMIN in a user namespace to read host proc on typical Docker/K8s/cloud nodes\u2014not init-namespace root; the DLPAR offline path needs admin but is not the lowest-privilege vector.\nUI:N - The attacker performs their own /proc/kpageflags reads or triggers kernel debug dumps; no separate victim action such as opening a file, mounting a filesystem, or approving a prompt is required beyond having local proc access.\nS:U - Impact is a kernel oops/panic within the host kernel security boundary; there is no VM escape, IOMMU bypass, or cross-authority resource access beyond crashing or destabilizing the shared kernel.\nC:H - snapshot_page() performs memcpy of a full struct page from foliop-\u003e__page_2 when only two pages are valid for order-1 folios, reading beyond allocated vmemmap into an unmapped hole; this out-of-bounds kernel read can expose adjacent mapped memmap bytes to the snapshot buffer on some layouts before faulting.\nI:N - The defect is a read past valid folio memmap that page-faults in kernel mode; memcpy only fills a local page_snapshot buffer and does not corrupt kernel objects, enable arbitrary writes, or provide a control-flow hijack primitive.\nA:H - Reading absent vmemmap for order-1 folios at section boundaries causes a supervisor page fault and kernel oops, as demonstrated during DLPAR memory remove on ppc64le; repeated /proc/kpageflags scanning can reliably panic or hang large-memory cloud/LPAR hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:12.733Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c649324571206a30949765320b91ccdb4c1722dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"
        }
      ],
      "title": "mm/util: don\u0027t read __page_2 for order-1 folios in snapshot_page()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80685",
    "datePublished": "2026-08-28T06:52:51.305Z",
    "dateReserved": "2026-08-26T14:34:25.784Z",
    "dateUpdated": "2026-08-29T06:22:12.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80685",
      "date": "2026-09-15",
      "epss": "0.00124",
      "percentile": "0.02416"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80685\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:53.963\",\"lastModified\":\"2026-08-29T07:16:51.120\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/util: don\u0027t read __page_2 for order-1 folios in snapshot_page()\\n\\nsnapshot_page() currently reads __page_2 after checking nr_pages \u003e 1, but\\nit should only do so when nr_pages \u003e 2.\\n\\nIf an order-1 folio is allocated at the end of a vmemmap section,\\n__page_2 will not exist and reading it will cause a fault.\\n\\nDuring DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed\\non the page isolation path while reading an order-1 folio\u0027s __page_2 from\\nan adjacent absent section (unmapped vmemmap).\\n\\nFix this to avoid reading memmap that doesn\u0027t exist (e.g., a vmemmap\\nhole).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"31a31da8a6187f1e5448ec73222e01d7d3fed4aa\",\"lessThan\":\"9668ffe0e2a5e2399dce281620198a2e415871fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"31a31da8a6187f1e5448ec73222e01d7d3fed4aa\",\"lessThan\":\"c649324571206a30949765320b91ccdb4c1722dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"31a31da8a6187f1e5448ec73222e01d7d3fed4aa\",\"lessThan\":\"7441d6348c70738e9ed307510db171c7a9b3f4bf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c649324571206a30949765320b91ccdb4c1722dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-02T08:20:08+00:00",
      "cve": "CVE-2026-80685",
      "id": "CVE-2026-80685",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/util: don\u0027t read __page_2 for order-1 folios in snapshot_page()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80685.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:04:23Z",
      "cve": "CVE-2026-80685",
      "id": "CVE-2026-80685",
      "initial_release_date": "2026-08-28T16:34:11Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80685",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80685.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.