CVE-2026-80682 Overview
CVE-2026-80682 is a Linux kernel vulnerability in the RISC-V memory management subsystem. The flaw involves an incorrect unit conversion when computing vmemmap_start_pfn, where MAX_FOLIO_VMEMMAP_ALIGN (measured in bytes of struct page storage) was fed directly into VMEMMAP_ADDR_ALIGN (used to align physical addresses). On systems where the DRAM base is not aligned to MAX_FOLIO_NR_PAGES * PAGE_SIZE, such as QEMU virt machines, this triggers a warning in sparse_init and violates the mask-based compound_info alignment requirement.
Critical Impact
A local attacker with low privileges can exploit the alignment mismatch in the RISC-V vmemmap initialization path to compromise kernel memory integrity, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- Linux kernel on RISC-V architecture
- Kernels containing commit 476849b0fba4 ("riscv/mm: align vmemmap to maximal folio size")
- RISC-V platforms where physical DRAM base is not naturally aligned to MAX_FOLIO_NR_PAGES * PAGE_SIZE (for example, QEMU virt)
Discovery Timeline
- 2026-08-28 - CVE-2026-80682 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80682
Vulnerability Analysis
The vulnerability resides in the RISC-V arch/riscv/mm code path that computes vmemmap_start_pfn. The kernel rounds phys_ram_base down to VMEMMAP_ADDR_ALIGN to establish the base of the sparse memory map. Because VMEMMAP_ADDR_ALIGN operates in the physical-address domain, any value supplied to it must also be expressed in bytes of physical memory.
Commit 476849b0fba4 attempted to enforce maximal folio alignment by feeding MAX_FOLIO_VMEMMAP_ALIGN directly into VMEMMAP_ADDR_ALIGN. However, MAX_FOLIO_VMEMMAP_ALIGN expresses alignment in bytes of struct page storage, not physical address bytes. This unit mismatch produces an incorrectly aligned vmemmap base on affected platforms.
The mask-based compound_info encoding requires pfn_to_page(0) to be naturally aligned to MAX_FOLIO_VMEMMAP_ALIGN. Commit 9f94db4c7eaa added compound_info_has_mask() alignment validation to mm/sparse.c, which surfaced the defect as a WARNING at sparse_init+0x58a/0x6fe during boot on QEMU virt hardware.
Root Cause
The root cause is an input validation error stemming from mixing two different alignment units in a single expression. MAX_FOLIO_VMEMMAP_ALIGN describes the required alignment of the virtual memmap array in units of struct page bytes. VMEMMAP_ADDR_ALIGN expects a physical-memory byte value. Passing the former into the latter without conversion breaks the invariant enforced by the sparse memory subsystem.
Attack Vector
Exploitation requires local access with low privileges on an affected RISC-V system. The flaw is triggered during early kernel initialization, and the resulting misaligned vmemmap corrupts the association between physical frame numbers and struct page entries. An attacker interacting with kernel memory management primitives could leverage the misalignment to influence adjacent page metadata, escalate privileges, or crash the system.
The vulnerability manifests deterministically on affected RISC-V hardware where phys_ram_base is not aligned to MAX_FOLIO_NR_PAGES * PAGE_SIZE. See the kernel commit for the corrected alignment logic.
Detection Methods for CVE-2026-80682
Indicators of Compromise
- Boot-time kernel WARNING at mm/sparse.c:365 in sparse_init+0x58a/0x6fe on RISC-V hardware
- Kernel log entries referencing compound_info_has_mask() alignment failures
- Unexpected struct page metadata inconsistencies reported by memory management sanity checks
Detection Strategies
- Audit RISC-V build banners and uname -r output against the fixed stable kernel commits 11ad86830a78 and 45ebe4540817
- Parse dmesg and boot logs for sparse_init warnings that indicate the alignment mismatch
- Correlate crash telemetry from RISC-V hosts with kernel version metadata to identify vulnerable fleets
Monitoring Recommendations
- Forward RISC-V kernel logs to a centralized logging pipeline and alert on sparse_init warnings
- Track unexpected reboots, oopses, and page-related kernel panics on RISC-V workloads
- Monitor privilege boundary events on RISC-V systems that host multi-tenant workloads or untrusted local users
How to Mitigate CVE-2026-80682
Immediate Actions Required
- Apply the upstream RISC-V memory management fix that converts MAX_FOLIO_VMEMMAP_ALIGN to the equivalent physical alignment before use in VMEMMAP_ADDR_ALIGN
- Rebuild and redeploy custom RISC-V kernels using the patched sources referenced in the stable tree
- Restrict local, low-privilege access on affected RISC-V hosts until patched kernels are installed
Patch Information
The fix is available in the upstream Linux stable tree via commits 11ad86830a78 and 45ebe4540817. The patch converts the folio-based alignment into its physical-address equivalent before passing it to VMEMMAP_ADDR_ALIGN, preserving the existing round_down() logic while satisfying the mask-alignment requirement.
Workarounds
- Boot affected RISC-V systems on platforms whose physical DRAM base is naturally aligned to MAX_FOLIO_NR_PAGES * PAGE_SIZE
- Where feasible, revert commit 476849b0fba4 on custom kernels until the corrected patch is integrated
- Limit exposure of RISC-V hosts to untrusted local users and constrain workloads that stress the memory management subsystem
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.