Executive brief
The Linux kernel's DRM graphics memory helper did not properly validate virtual memory boundaries when installing huge page mappings. This could allow a local attacker with access to graphics applications to trigger kernel memory corruption, potentially leading to denial of service or privilege escalation.
Technical details
The vulnerability exists in the drm/shmem_helper huge_fault handler in drivers/gpu/drm/drm_gem_shmem_helper.c. The code attempted to install PMD (Page Middle Directory) sized huge page mappings without checking whether the mapped region exceeds the boundaries of the virtual memory area (VMA). When a huge page mapping violates VMA boundaries, it can trigger a VM_BUG_ON_VMA() assertion deep in the copy_pmd_range() function. The fix adds boundary validation (checking that vma->vm_start <= start && end <= vma->vm_end) before installing the PMD mapping. This is a local memory safety issue affecting GPU drivers on systems with CONFIG_ARCH_SUPPORTS_PMD_PFNMAP enabled. The patch was merged in June 2026 and backported to stable kernel branches.
Affected products
- Linux Linux Kernel affected versions prior to fix commit 617bbd08714857c1613d7c550d43a9092ec0fb97 (2026-06-22)
Timeline
- 2026-08-26: disclosed: CVE-2026-80582 published on NVD
- 2026-06-22: patched: Fix commit 617bbd08714857c1613d7c550d43a9092ec0fb97 authored