CVE-2026-80582

A flaw was found in the Linux kernel's drm/shmem_helper component. This vulnerability arises from insufficient boundary checks when handling large memory pages. An attacker could potentially trigger an attempt to map memory outside its designated area. This improper memory handling could lead to a system crash, resulting in a Denial of Service (DoS).

drm shmem helper can install a PMD huge page mapping that extends outside the VMA when the fault address is PMD aligned with the physical address but the VMA does not cover the full PMD range. This violates VMA boundary assumptions and can later hit VM_BUG_ON_VMA in copy_pmd_range, causing a local kernel crash during operations such as fork or page table copy. For the CVSS the PR:L is used because a local user with access to an affected DRM mmap path or render node may be able to create the mapping and trigger the follow up MM path, while no administrator privileges are inherently required on systems exposing such devices to users. The issue is not network reachable. Impact is at least denial of service and the paranoid score keeps C:L and I:L because an out of VMA PMD mapping is a page table boundary violation that may affect access semantics, but the patch does not show a strong arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.