CVE-2026-80963

A flaw was found in the Linux kernel's dm-stats module. This vulnerability occurs when the allocation of per-CPU data fails, which can lead to a null pointer dereference during the subsequent cleanup operation. This issue can cause the system to crash, resulting in a Denial of Service (DoS).

A low impact vulnerability was found in the Linux kernel's device-mapper statistics (dm-stats) code used in Red Hat Enterprise Linux. If the allocation of per-CPU statistics data fails, the error path calls dm_stat_free(), which frees per-CPU histogram data without first checking whether the per-CPU statistics pointer is NULL, resulting in a NULL pointer dereference and a kernel crash (local denial of service). Exploiting this flaw requires local access to the system and depends on the per-CPU allocation actually failing, for example under severe memory pressure, which makes reliable triggering difficult. Because of these constraints, Red Hat rates the overall impact of this issue as low, even though the Red Hat CVSS 3.1 base score is 5.5 (moderate), reflecting the high availability impact if a crash is successfully triggered. Red Hat Enterprise Linux kernel packages are affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.