HIGH Introduced in 6.15
mm FolioSnapshot OOB
CVE-2026-80685
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap). Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).
02KernelScan AI Analysis
Risk summary
A kernel oops can be triggered during page isolation on systems with sparse vmemmap, such as large ppc64le LPARs undergoing DLPAR memory remove. The bug is a local denial of service that requires privileged access to initiate memory management operations.
Vulnerability analysis
When the kernel snapshots a folio during page isolation, it unconditionally copies a third page of metadata for any folio larger than a single page, even though that metadata only exists for folios of order 2 or greater. For an order-1 folio located at the end of a vmemmap section, the adjacent memory map entry is absent and reading it faults, crashing the kernel. The fix changes the condition so the extra page is only copied when the folio actually has more than two pages, avoiding access to non-existent memory map entries. This path is reached during page isolation on systems with sparse vmemmap, such as large ppc64le LPARs undergoing DLPAR memory remove; a privileged local actor who can initiate memory hot-remove operations can trigger a kernel panic.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12.111 | 6.13 | 9668ffe0e2a5 |
| 6.18 | 6.15 | 6.18.44 | c64932457120 |
| 7.1 | 6.15 | 7.1.8 | 7441d6348c70 |
| mainline | 6.15 | 7.2 | — |