CVE-2026-80685 Overview
CVE-2026-80685 is a Linux kernel vulnerability in the memory management subsystem. The flaw resides in the snapshot_page() function in mm/util, which incorrectly reads __page_2 for order-1 folios. When an order-1 folio is allocated at the end of a vmemmap section, __page_2 does not exist, and reading it triggers a fault.
The issue was observed during a Dynamic Logical Partitioning (DLPAR) memory remove operation on a 22 TB ppc64le LPAR, where snapshot_page() oopsed on the page isolation path while reading an adjacent absent section (unmapped vmemmap). The bug represents an out-of-bounds read against a vmemmap hole.
Critical Impact
A local, low-privileged user can trigger a kernel oops leading to denial of service on affected Linux systems, particularly ppc64le platforms performing memory hotplug operations.
Affected Products
- Linux kernel versions containing the flawed snapshot_page() logic in mm/util
- ppc64le LPAR systems performing DLPAR memory hotplug operations
- Systems with sparse vmemmap layouts where order-1 folios may sit at section boundaries
Discovery Timeline
- 2026-08-28 - CVE-2026-80685 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80685
Vulnerability Analysis
The Linux kernel represents contiguous groups of pages as folios. A folio of order N covers 2^N contiguous pages. The snapshot_page() helper in mm/util.c captures a stable copy of folio metadata for callers such as the page isolation path.
The function currently guards access to __page_2 behind a check for nr_pages > 1. However, __page_2 is the third page in the folio structure and only exists when the folio contains at least three pages. For an order-1 folio, nr_pages equals 2, so the guard passes but the read targets memory that is not part of the folio.
On systems using sparse vmemmap, memory sections may be absent or unmapped. When an order-1 folio sits at the last position of a vmemmap section, the address computed for __page_2 falls into an adjacent unmapped section, producing a kernel page fault and an oops.
Root Cause
The root cause is an incorrect boundary check [CWE-125]. The condition nr_pages > 1 permits access to __page_2 when it should require nr_pages > 2. The off-by-one condition causes an out-of-bounds read of the struct page array (memmap) at the tail of a vmemmap section.
Attack Vector
Exploitation requires local access with low privileges. The attacker must induce allocation of an order-1 folio at a vmemmap section boundary and trigger a code path that invokes snapshot_page(), such as page isolation during memory hotplug or compaction. On ppc64le systems performing DLPAR memory remove, the condition can arise during normal administrative operations, producing a kernel oops and denial of service.
No verified proof-of-concept code is publicly available. Technical detail is documented in the upstream fix commits referenced by the kernel maintainers: Kernel Git Commit 7441d63, Kernel Git Commit 9668ffe, and Kernel Git Commit c649324.
Detection Methods for CVE-2026-80685
Indicators of Compromise
- Kernel oops messages referencing snapshot_page in the call trace, particularly during page isolation or memory hotplug operations
- Unexpected system panics or hangs on ppc64le LPARs during DLPAR memory remove operations
- Repeated faults reading struct page addresses that map to absent vmemmap sections
Detection Strategies
- Monitor dmesg and kernel ring buffers for oops signatures containing snapshot_page and the page isolation code paths
- Correlate DLPAR memory hotplug events with kernel crash reports on ppc64le LPARs
- Track kernel package versions across the fleet and compare against fixed builds identified in the upstream commits
Monitoring Recommendations
- Forward kernel facility syslog messages to a centralized logging platform and alert on Oops, BUG, or Unable to handle kernel paging request entries
- Enable kdump on production hosts so that any crash produces a vmcore for post-incident analysis
- Track memory hotplug operations on virtualized ppc64le workloads and flag repeated failures on the same LPAR
How to Mitigate CVE-2026-80685
Immediate Actions Required
- Apply the upstream kernel fix or a distribution-provided update that changes the guard in snapshot_page() from nr_pages > 1 to nr_pages > 2
- Prioritize patching on ppc64le LPARs that perform DLPAR memory hotplug or run large-memory workloads
- Restrict local shell access on multi-tenant systems until patched kernels are deployed
Patch Information
The fix is delivered through three upstream commits: Kernel Git Commit 7441d63, Kernel Git Commit 9668ffe, and Kernel Git Commit c649324. The patch corrects the nr_pages check in snapshot_page() so that __page_2 is only read when the folio contains more than two pages, preventing the out-of-bounds vmemmap read.
Workarounds
- Avoid DLPAR memory remove operations on affected ppc64le LPARs until the patched kernel is installed
- Reduce memory fragmentation pressure to lower the likelihood of order-1 folio placement at vmemmap section boundaries
- Where feasible, disable memory compaction and page isolation code paths that call snapshot_page() during maintenance windows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
