Executive brief
The Linux kernel's per-CPU memory allocator has a bitmap overflow bug when managing memory chunks with multiple units. An attacker with kernel code execution or local system access could exploit this to corrupt kernel memory, potentially leading to privilege escalation or denial of service.
Technical details
A bitmap overflow occurs in the pcpu_create_chunk() function within mm/percpu-km.c. The function calculates nr_pages as the total contiguous allocation (nr_units × pcpu_unit_pages) but passes this directly to pcpu_chunk_populated(), which treats it as a page offset for a bitmap sized to only pcpu_unit_pages. When nr_units > 1, this writes beyond the bounds of the chunk->populated bitmap. The vulnerability also corrupts global pcpu_nr_empty_pop_pages accounting. The bug was introduced in commit a63d4ac4ab609 and worsened by commit b539b87fed37f. The fix changes the function call from pcpu_chunk_populated(chunk, 0, nr_pages) to pcpu_chunk_populated(chunk, 0, chunk->nr_pages), properly constraining writes to the bitmap bounds.
Affected products
- Linux Linux Kernel all versions with percpu-km allocator (fixed in commit 01504da375f5b19df195cb1cb1cf1dd184318f97)
Timeline
- 2026-08-28: disclosed: CVE-2026-80718 published on NVD