CVE-2026-80685 mm/util: don't read __page_2 for order-1 folios in snapshot_page()
A kernel bug causes a crash when reading non-existent memory during page snapshot operations, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80685?
CVE-2026-80685 is a high-severity vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/util: don't read __page_2 for order-1 folios in snapshot_page()
snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2.
If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault.
During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap).
Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).
Which versions are affected by CVE-2026-80685?
How do I fix CVE-2026-80685?
Apply the vendor's patch.
Is CVE-2026-80685 being exploited?
There is no known exploitation of CVE-2026-80685 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80685, DEBIAN-CVE-2026-80685, GHSA-ccm4-344c-hjv9, UBUNTU-CVE-2026-80685.