CVE-2026-80685 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems, especially those utilizing DLPAR memory remove functionality, should assess exposure and prioritize verification of affected systems.

Why it matters

This vulnerability in the Linux kernel's snapshot_page() function can cause faults when reading __page_2 for order-1 folios, potentially leading to system instability. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with DLPAR memory remove functionality.

• Verification of affected Linux kernel versions is required to determine exposure.
• DLPAR memory remove functionality may be impacted by this vulnerability.
• Reading non-existent memmap can cause faults, potentially leading to system instability.

Technical summary

The Linux kernel's snapshot_page() function did not properly handle order-1 folios, leading to a potential fault when reading __page_2. The issue was resolved by modifying the function to only read __page_2 when nr_pages > 2. This change prevents reading non-existent memmap, such as a vmemmap hole, which can cause faults and potentially lead to system instability. The fix is particularly relevant for systems utilizing DLPAR memory remove functionality, where an order-1 folio might be allocated at the end of a vmemmap section. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with DLPAR memory remove functionality.

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the snapshot_page() function is updated.
• Verify that systems with DLPAR memory remove functionality are not exposed to this vulnerability.
• Monitor Linux kernel updates for potential related vulnerabilities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The issue was reported during DLPAR memory remove on a 22 TB ppc64le LPAR, where snapshot_page() oopsed on the page isolation path. The fix avoids reading memmap that doesn't exist, such as a vmemmap hole.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.