Out-of-bounds read in Linux kernel - CVE-2026-80685

Vulnerability details

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in snapshot_page() when processing an order-1 folio allocated at the end of a vmemmap section. A local attacker can trigger the page isolation path to cause a denial of service.

Exploitation requires an order-1 folio to be located adjacent to an absent vmemmap section.

Affected software

How to mitigate CVE-2026-80685

External References

• https://git.kernel.org/stable/c/7441d6348c70738e9ed307510db171c7a9b3f4bf
• https://git.kernel.org/stable/c/9668ffe0e2a5e2399dce281620198a2e415871fc
• https://git.kernel.org/stable/c/c649324571206a30949765320b91ccdb4c1722dc

Related Security Bulletins

• Out-of-bounds read in Linux kernel mm