CVE-2026-80685

A flaw was found in the Linux kernel's memory management subsystem. The snapshot_page() function attempts to read memory that may not exist when handling certain memory structures (order-1 folios) during specific memory operations, such as dynamic logical partitioning (DLPAR) memory removal. This out-of-bounds read can lead to a kernel fault (oops), resulting in a system crash and a Denial of Service (DoS).

An out-of-bounds read flaw rated LOW impact by Red Hat was found in the Linux kernel's memory management subsystem. The snapshot_page() function in mm/util reads __page_2 after only checking that a folio spans more than one page, but __page_2 exists only when a folio spans more than two pages. When an order-1 folio is allocated at the end of a vmemmap section, the read accesses memmap that does not exist (an adjacent absent, unmapped vmemmap section) and causes a kernel fault (oops). The issue was observed on the page isolation path during DLPAR memory removal on a large ppc64le LPAR, so triggering it requires privileged local memory-reconfiguration operations such as DLPAR memory remove or memory hotplug; the consequence is a system crash resulting in denial of service, with no confidentiality or integrity impact because the read causes a fault rather than a controlled disclosure. For this reason Red Hat's severity (CVSS 5.5, Moderate, LOW impact) is lower than the upstream CVEORG score (7.1, Important), which credits a high confidentiality impact. Of the currently tracked Red Hat product streams, the Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected because the vulnerable code is not present in them; the one remaining flagged stream (the rhel-6-els kernel) is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.