CVE-2026-80963: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80963 Overview

CVE-2026-80963 is a NULL pointer dereference vulnerability in the Linux kernel's dm-stats component, part of the device-mapper subsystem. The flaw resides in the per-CPU data allocation cleanup path. When dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu)) fails, the code jumps to the out label and invokes dm_stat_free. That cleanup routine iterates through all possible CPUs and dereferences s->stat_percpu[cpu][0].histogram without validating that s->stat_percpu[cpu] was successfully allocated. If the pointer is NULL, the kernel crashes.

Critical Impact
A NULL pointer dereference in kernel context triggers a system crash, producing a denial-of-service condition on affected Linux hosts using device-mapper statistics.

Affected Products

Linux kernel (device-mapper dm-stats subsystem)
Stable kernel branches referenced by the upstream fix commits
Distributions shipping vulnerable kernel versions prior to backport

Discovery Timeline

2026-09-11 - CVE-2026-80963 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80963

Vulnerability Analysis

The dm-stats module maintains per-CPU statistics arrays for device-mapper targets. During initialization, the kernel allocates per-CPU memory in a loop using dm_kvzalloc. Each allocation may fail independently under memory pressure or on NUMA nodes with constrained resources.

When an allocation fails partway through the loop, error handling jumps to the out label. The dm_stat_free cleanup function then iterates through every possible CPU with for_each_possible_cpu(cpu) and calls dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size). Because the failing CPU's stat_percpu slot was never populated, the pointer remains NULL. Dereferencing it triggers a kernel oops.

The fix adds a NULL check on s->stat_percpu[cpu] before accessing the nested histogram field, ensuring the cleanup path is safe under partial allocation failure.

Root Cause

The root cause is missing NULL validation in an error-handling cleanup routine. The allocation loop can exit early with a sparse stat_percpu array, but the free routine assumes all slots are initialized. This is a classic asymmetry between the setup and teardown code paths in kernel resource management.

Attack Vector

Triggering this vulnerability requires the ability to invoke dm-stats operations that allocate per-CPU histograms while the kernel is under memory pressure sufficient to fail dm_kvzalloc. This typically requires local access with permissions to configure device-mapper targets. It is not a remote code execution primitive; the observable impact is a kernel crash and denial of service.

See the upstream commit 0c8f7870 for the exact source-level change that adds the NULL guard.

Detection Methods for CVE-2026-80963

Indicators of Compromise

Kernel oops or panic messages referencing dm_stat_free, dm_kvfree, or stat_percpu in dmesg or /var/log/kern.log.
Unexpected host reboots on systems that heavily use device-mapper with dm-stats enabled (LVM, DM-cache, DM-thin).
Memory allocation failure warnings from dm_kvzalloc preceding the crash.

Detection Strategies

Inventory running kernel versions across Linux estate and cross-reference against fixed versions listed in the stable kernel commits.
Monitor kernel crash reports and system reboots for patterns matching the dm-stats cleanup call path.
Correlate memory-pressure events with device-mapper administrative activity to identify at-risk workloads.

Monitoring Recommendations

Forward dmesg and kernel logs to a centralized logging platform and alert on oops signatures containing dm_stat_free.
Track host uptime metrics and alert on unexpected reboots for servers running LVM, dm-cache, or dm-thin volumes.
Enable kdump on production hosts to capture crash dumps that confirm root cause when the fault triggers.

How to Mitigate CVE-2026-80963

Immediate Actions Required

Identify all Linux hosts running affected kernel versions, prioritizing systems that expose device-mapper administration to non-root users or containers.
Apply the stable kernel update from your distribution vendor as soon as it is available.
Reduce sustained memory pressure on hosts where dm-stats is actively used to lower the probability of allocation failures.

Patch Information

The upstream fix is available across multiple stable branches. Relevant kernel commits include 0c8f7870, 389a50d0, 564d1757, 74210fa0, 9805d87d, c3f211b7, cc87e26d, and e45f0b0c. Consult your Linux distribution's security advisories for the exact package versions containing the backport.

Workarounds

Avoid enabling dm-stats on devices that are not actively monitored to reduce the code path exposure.
Restrict CAP_SYS_ADMIN and device-mapper control access to trusted administrators only.
Ensure adequate memory headroom on hosts using device-mapper to minimize allocation-failure conditions.

bash

# Verify the running kernel version and compare against patched builds
uname -r

# Check whether dm-stats is currently tracking any devices
dmsetup stats list

# Review recent kernel messages for dm_stat_free or allocation failures
dmesg -T | grep -Ei 'dm_stat|dm_kvzalloc|stat_percpu'