CVE-2026-80718

A flaw was found in the Linux kernel. Specifically, within the mm/percpu-km module, the pcpu_create_chunk() function incorrectly calculates the size of a bitmap used for tracking memory pages. This miscalculation can lead to a bitmap overflow, where data is written beyond the intended memory boundary. Such an issue can result in memory corruption, potentially allowing a local attacker to escalate privileges or cause a system crash (Denial of Service).

A moderate severity flaw was found in the Linux kernel percpu-km allocator. In pcpu_create_chunk(), the nr_pages value passed to pcpu_chunk_populated() is the total contiguous backing allocation (nr_units * pcpu_unit_pages), but the chunk->populated bitmap it fills is sized for a single unit (pcpu_unit_pages). When more than one percpu unit is present, setting the bitmap writes beyond the end of chunk->populated, corrupting adjacent kernel memory; the same mismatch also breaks the global pcpu_nr_empty_pop_pages accounting. A local low-privileged user would have to create enough percpu allocation pressure to force the creation of a new chunk to trigger the flaw. The result is kernel memory corruption that can crash the kernel (denial of service) and, in the worst case, affect the confidentiality or integrity of kernel memory. Red Hat scored this flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the CVE.org score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), because reliably exploiting the bitmap overflow to achieve a controlled impact requires high attack complexity. All Red Hat Enterprise Linux (kernel, kernel-rt) and Red Hat In-Vehicle OS (kernel, kernel-ivos-qualcomm) versions listed in this flaw have been assessed as not affected because the vulnerable code is not present in the shipped kernels, so no action is required for Red Hat customers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.