{"id":"CVE-2026-80685","state":"PUBLISHED","title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/util: don't read __page_2 for order-1 folios in snapshot_page()\n\nsnapshot_page() currently reads __page_2 after checking nr_pages > 1, but\nit should only do so when nr_pages > 2.\n\nIf an order-1 folio is allocated at the end of a vmemmap section,\n__page_2 will not exist and reading it will cause a fault.\n\nDuring DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed\non the page isolation path while reading an order-1 folio's __page_2 from\nan adjacent absent section (unmapped vmemmap).\n\nFix this to avoid reading memmap that doesn't exist (e.g., a vmemmap\nhole).","publishedAt":"2026-08-28T06:52:51.305Z","updatedAt":"2026-09-21T13:14:10.006Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"31a31da8a6187f1e5448ec73222e01d7d3fed4aa","status":"affected","lessThan":"9668ffe0e2a5e2399dce281620198a2e415871fc","versionType":"git"},{"version":"31a31da8a6187f1e5448ec73222e01d7d3fed4aa","status":"affected","lessThan":"c649324571206a30949765320b91ccdb4c1722dc","versionType":"git"},{"version":"31a31da8a6187f1e5448ec73222e01d7d3fed4aa","status":"affected","lessThan":"7441d6348c70738e9ed307510db171c7a9b3f4bf","versionType":"git"},{"version":"4117738bd42c8ab58090729daf0f8472a936f662","status":"affected","versionType":"git"},{"version":"6.12.111","status":"affected","lessThan":"6.13","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/util.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/util.c"]}],"references":["https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc","https://git.kernel.org/stable/c/c649324571206a30949765320b91ccdb4c1722dc","https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80685.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80685","state":"PUBLISHED","datePublished":"2026-08-28T06:52:51.305Z","dateUpdated":"2026-09-21T13:14:10.006Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.784Z"},"containers":{"cna":{"title":"mm/util: don't read __page_2 for order-1 folios in snapshot_page()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/util: don't read __page_2 for order-1 folios in snapshot_page()\n\nsnapshot_page() currently reads __page_2 after checking nr_pages > 1, but\nit should only do so when nr_pages > 2.\n\nIf an order-1 folio is allocated at the end of a vmemmap section,\n__page_2 will not exist and reading it will cause a fault.\n\nDuring DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed\non the page isolation path while reading an order-1 folio's __page_2 from\nan adjacent absent section (unmapped vmemmap).\n\nFix this to avoid reading memmap that doesn't exist (e.g., a vmemmap\nhole)."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"31a31da8a6187f1e5448ec73222e01d7d3fed4aa","status":"affected","lessThan":"9668ffe0e2a5e2399dce281620198a2e415871fc","versionType":"git"},{"version":"31a31da8a6187f1e5448ec73222e01d7d3fed4aa","status":"affected","lessThan":"c649324571206a30949765320b91ccdb4c1722dc","versionType":"git"},{"version":"31a31da8a6187f1e5448ec73222e01d7d3fed4aa","status":"affected","lessThan":"7441d6348c70738e9ed307510db171c7a9b3f4bf","versionType":"git"},{"version":"4117738bd42c8ab58090729daf0f8472a936f662","status":"affected","versionType":"git"},{"version":"6.12.111","status":"affected","lessThan":"6.13","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/util.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/util.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc"},{"url":"https://git.kernel.org/stable/c/c649324571206a30949765320b91ccdb4c1722dc"},{"url":"https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Reachable via local read(2) on /proc/kpageflags or /proc/kpagecount (kpage_read→stable_page_flags/get_kpage_count→snapshot_page); the reported production crash also occurs on the memory-hotplug page-isolation dump_page path during offline_pages/DLPAR, with no network or physical-bus entry point.\nAC:L - A container/user-namespace root can sequentially scan PFNs via /proc/kpageflags until snapshot_page hits an order-1 folio at a vmemmap section boundary; on large SPARSEMEM_VMEMMAP systems such folios exist naturally (22 TB ppc64le LPAR oops) without races or attacker-uncontrollable timing.\nPR:L - /proc/kpage* is mode 0400 (root-only); exploitation needs only namespace/container root or CAP_SYS_ADMIN in a user namespace to read host proc on typical Docker/K8s/cloud nodes—not init-namespace root; the DLPAR offline path needs admin but is not the lowest-privilege vector.\nUI:N - The attacker performs their own /proc/kpageflags reads or triggers kernel debug dumps; no separate victim action such as opening a file, mounting a filesystem, or approving a prompt is required beyond having local proc access.\nS:U - Impact is a kernel oops/panic within the host kernel security boundary; there is no VM escape, IOMMU bypass, or cross-authority resource access beyond crashing or destabilizing the shared kernel.\nC:H - snapshot_page() performs memcpy of a full struct page from foliop->__page_2 when only two pages are valid for order-1 folios, reading beyond allocated vmemmap into an unmapped hole; this out-of-bounds kernel read can expose adjacent mapped memmap bytes to the snapshot buffer on some layouts before faulting.\nI:N - The defect is a read past valid folio memmap that page-faults in kernel mode; memcpy only fills a local page_snapshot buffer and does not corrupt kernel objects, enable arbitrary writes, or provide a control-flow hijack primitive.\nA:H - Reading absent vmemmap for order-1 folios at section boundaries causes a supervisor page fault and kernel oops, as demonstrated during DLPAR memory remove on ppc64le; repeated /proc/kpageflags scanning can reliably panic or hang large-memory cloud/LPAR hosts."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-09-21T13:14:10.006Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.111"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}