HIGH Introduced in 7.0
drm shmem_helper PMD Boundary OOB
CVE-2026-80582
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other ->huge_fault handlers have similar checks and the resulting mapping will trigger a VM_BUG_ON_VMA() if it ever reaches copy_pmd_range().
02KernelScan AI Analysis
Risk summary
A local unprivileged user can trigger a kernel BUG_ON (panic) by causing the DRM shmem helper to install a PMD huge page mapping that exceeds VMA boundaries, leading to a denial of service.
Vulnerability analysis
The kernel's shared-memory graphics helper can create an oversized huge-page mapping that extends beyond the bounds of the affected memory region. If that invalid mapping is later processed during a page-table update, the kernel hits a debug assertion and panics. The fix adds a range check so the mapping is only created when the entire huge page fits inside the region. Any local user with access to a graphics device that uses this helper can trigger the flaw by mapping device memory and forcing a huge-page fault.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 7.0 | 7.1.10 | 12803e89a1e5 |
| mainline | 7.0 | 7.2 | 617bbd087148 |