Cloudanix VulnDB

CVE-2026-80718

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how the Linux kernel manages certain memory areas could let someone who already has access to the computer take full control or crash the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in pcpu_create_chunk() due to using nr_pages (nr_units * pcpu_unit_pages) to populate a bitmap sized for pcpu_unit_pages, plus incorrect pcpu_nr_empty_pop_pages accounting.

Why it matters to the business

Local attackers can corrupt kernel memory, leading to crashes, data corruption, or full system compromise on affected Linux systems.

How an attack unfolds

An attacker with local access triggers percpu chunk creation with nr_units greater than 1, causing the overflow during bitmap setup and subsequent accounting errors that enable memory corruption.

How to fix it

Update to a Linux kernel containing the fix for the bitmap and accounting issues in percpu-km (post commit b539b87fed37f adjustments).

How to confirm the fix worked

Verify the kernel source contains the corrected use of chunk->nr_pages in pcpu_create_chunk() and pcpu_chunk_populated(), then rebuild and boot the updated kernel.

Typical attack path

  1. Obtain local code execution on the target system
  2. Trigger percpu allocation paths that invoke pcpu_create_chunk() with multiple units
  3. Exploit the resulting out-of-bounds bitmap write to corrupt adjacent kernel structures
  4. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for percpu allocation errors or bitmap-related warnings; inspect for unexpected crashes after percpu operations.

What your security team should do

  • Prioritize kernel updates on all multi-CPU systems where local access is possible
  • Monitor for kernel oops or percpu-related panics as potential indicators
  • Restrict local unprivileged access where feasible until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed. When nr_units > 1, the function writes beyond chunk->populated. Fix it by using chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly") introduced the bitmap overflow issue. Later, commit b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the accounting issue.

Affected packages

Ecosystem Package Introduced Fixed