Linux Kernel: percpu-km bitmap overflow in pcpu_create_chunk()
CVE-2026-80718 Published on August 28, 2026
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
In the Linux kernel, the following vulnerability has been resolved:
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
In pcpu_create_chunk(), nr_pages is the total contiguous backing
allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
Since bit N in chunk->populated means page offset N inside every unit is
backed. When nr_units > 1, the function writes beyond chunk->populated.
Fix it by using chunk->nr_pages.
It also fixes the global pcpu_nr_empty_pop_pages accounting, since
pcpu_balance_free() only iterates up to chunk->nr_pages.
Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
properly") introduced the bitmap overflow issue. Later, commit
b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
accounting issue.
Products Associated with CVE-2026-80718
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 5f43d2c1bea280dcdfabaf156c25e7402fb8039f is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 92c43ac3c2b09eb16162e8144e73c00b7c3e29d6 is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 6fc7da2a052f2825fff785e860e67183f5acaaba is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 01504da375f5b19df195cb1cb1cf1dd184318f97 is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below a6940b84c8c035da465b7165fdfcfb005545724e is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 32134cf9211b83bed9076d0739c5906fbea4c763 is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 5c7fc39bf19abb38a996aaad77b3e3a8f48581c3 is affected.
- Version a63d4ac4ab6094c051a5a240260d16117a7a2f86 and below 89b1b79c308818a715e75f28744b70d8940a07c9 is affected.
- Version 3.18 is affected.
- Before 3.18 is unaffected.
- Version 5.10.265, <= 5.10.* is unaffected.
- Version 5.15.216, <= 5.15.* is unaffected.
- Version 6.1.183, <= 6.1.* is unaffected.
- Version 6.6.151, <= 6.6.* is unaffected.
- Version 6.12.103, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.