CVE-2026-80718: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80718 Overview

CVE-2026-80718 is a memory corruption vulnerability in the Linux kernel's per-CPU memory allocator (mm/percpu-km). The flaw resides in pcpu_create_chunk(), where nr_pages represents the total contiguous backing allocation (nr_units * pcpu_unit_pages) but is incorrectly passed to pcpu_chunk_populated(). That function uses the value to set the chunk->populated bitmap, whose size is only pcpu_unit_pages. When nr_units > 1, the write extends beyond the bitmap boundary. The bug also corrupts the global pcpu_nr_empty_pop_pages counter because pcpu_balance_free() iterates only up to chunk->nr_pages.

Critical Impact
Local, low-privileged code paths that trigger per-CPU chunk creation can corrupt kernel memory adjacent to the chunk->populated bitmap, threatening confidentiality, integrity, and availability of the host.

Affected Products

Linux kernel builds using the percpu-km allocator (typically CONFIG_NOMMU configurations)
Stable kernel branches prior to the fixes referenced in the upstream commits listed below
Downstream distributions that ship kernels containing commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly") without the corrective patches

Discovery Timeline

2026-08-28 - CVE-2026-80718 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80718

Vulnerability Analysis

The Linux kernel's per-CPU memory subsystem manages allocations divided into chunks, each composed of one or more units. Every unit has pcpu_unit_pages backing pages, and the per-chunk populated bitmap tracks which page offsets inside each unit are backed. In pcpu_create_chunk(), nr_pages reflects the total contiguous allocation across all units, computed as nr_units * pcpu_unit_pages.

The defect is a bitmap sizing mismatch. pcpu_chunk_populated() was called with nr_pages, but the chunk->populated bitmap is sized to pcpu_unit_pages. When nr_units > 1, bits beyond the bitmap's allocated length are written, producing an out-of-bounds write into adjacent kernel memory.

A secondary defect affects accounting. The global pcpu_nr_empty_pop_pages counter is incremented as if all nr_pages are tracked, but pcpu_balance_free() only walks up to chunk->nr_pages, resulting in a persistent counter drift that can distort allocator behavior. The fix replaces nr_pages with chunk->nr_pages at both call sites.

Root Cause

The root cause is an incorrect length argument passed to a bitmap-manipulation helper, introduced by commit a63d4ac4ab609. The accounting drift was introduced later by commit b539b87fed37f ("percpu: implement pcpu_nr_empty_pop_pages and chunk->nr_populated"). Both defects share the same conceptual error: conflating a whole-chunk page count with a per-unit page count. This is an out-of-bounds write [CWE-787] within kernel memory management.

Attack Vector

Exploitation requires local access and low privileges. An attacker must trigger a code path that invokes pcpu_create_chunk() with a configuration where nr_units > 1. On successful triggering, kernel memory adjacent to chunk->populated is overwritten, which can be leveraged for privilege escalation, kernel information disclosure, or denial of service. No user interaction or network exposure is required.

Verified proof-of-concept code for this issue is not publicly available. Refer to the upstream commits for the precise instruction sequence corrected by the patch.

Detection Methods for CVE-2026-80718

Indicators of Compromise

Unexpected kernel panics or BUG: reports referencing pcpu_create_chunk, pcpu_chunk_populated, or per-CPU allocator internals
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds writes near chunk->populated bitmaps
Inconsistent values in /proc/percpu_stats or drift in pcpu_nr_empty_pop_pages observed via kernel debug interfaces

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds write on affected code paths
Audit installed kernel package versions across the fleet and compare against the fixed commit hashes (01504da3, 32134cf9, 5c7fc39b, 5f43d2c1, 6fc7da2a, 89b1b79c, 92c43ac3, a6940b84)
Monitor dmesg and journald for slab corruption and per-CPU allocator warnings following high-load allocation events

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on slab-out-of-bounds, KASAN, and pcpu_ string matches
Track kernel version telemetry from endpoint agents to identify unpatched hosts running vulnerable builds
Correlate unexpected reboots or kernel oops events with local process activity to identify potential exploitation attempts

How to Mitigate CVE-2026-80718

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 01504da3, 32134cf9, 5c7fc39b, 5f43d2c1, 6fc7da2a, 89b1b79c, 92c43ac3, and a6940b84
Update to distribution kernel packages that incorporate the fix once vendor advisories publish
Restrict local shell and container break-out surfaces on hosts pending patching, since the attack vector is local

Patch Information

The fix replaces the nr_pages argument passed to pcpu_chunk_populated() with chunk->nr_pages, correcting both the bitmap sizing and the pcpu_nr_empty_pop_pages accounting. Patches are available across multiple stable branches. See the Kernel Git Commit 01504da3, Kernel Git Commit 32134cf9, Kernel Git Commit 5c7fc39b, Kernel Git Commit 5f43d2c1, Kernel Git Commit 6fc7da2a, Kernel Git Commit 89b1b79c, Kernel Git Commit 92c43ac3, and Kernel Git Commit a6940b84.

Workarounds

No configuration-based workaround exists; the defect resides in core allocator logic. Patching is the only durable remediation.
On systems where kernel updates must be deferred, minimize local attacker footholds by tightening seccomp, namespace, and container isolation policies
Reduce exposure of workloads that force multi-unit per-CPU chunk allocations until kernels are updated

bash

# Verify the running kernel version and compare against fixed stable releases
uname -r

# Debian/Ubuntu: install the latest patched kernel
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)

# RHEL/CentOS/Fedora: update the kernel package
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot