Executive brief
The Linux kernel's device-mapper statistics module contains a null pointer dereference bug in error handling. When per-CPU memory allocation fails during dm-stats initialization, the cleanup code attempts to access memory that was never allocated, causing a kernel crash. This can lead to denial of service if an attacker or misconfiguration triggers the allocation failure.
Technical details
This is a null pointer dereference vulnerability in drivers/md/dm-stats.c in the dm_stat_free function. The root cause is incomplete error handling: when dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu)) fails during per-CPU allocation, the code jumps to the error path and calls dm_stat_free, which iterates over all possible CPUs and attempts to free s->stat_percpu[cpu] without first checking if it is NULL. The fix adds a null pointer check (if (s->stat_percpu[cpu])) before dereferencing the pointer. This is a local denial-of-service issue; the attack vector is local (triggering memory allocation failures), and the impact is kernel crash/unavailability.
Affected products
- Linux Linux kernel Multiple (fix applied across 2.6.11 through 7.2.y branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-80963 published
- 2026-08-03: patched: Fix committed by Mikulas Patocka
- 2026-09-07: patched: Fix merged to stable tree (linux-6.12.y)