Look up another CVE · open CVE-2026-80682 in the interactive tracker
CVE-2026-80682
riscv/mm: use physical alignment for vmemmap_start_pfn
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem arch/riscv. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80682 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
RISC-V computes vmemmap_start_pfn by rounding phys_ram_base down to VMEMMAP_ADDR_ALIGN. That alignment must therefore be expressed in the physical-address domain. Commit 476849b0fba4 ("riscv/mm: align vmemmap to maximal folio size") attempted to account for the maximal folio alignment by feeding MAX_FOLIO_VMEMMAP_ALIGN directly into VMEMMAP_ADDR_ALIGN. However, MAX_FOLIO_VMEMMAP_ALIGN is measured in bytes of struct page storage, whereas VMEMMAP_ADDR_ALIGN is used to align a physical address. The mask-based compound_info encoding requires pfn_to_page(0) to be naturally aligned to MAX_FOLIO_VMEMMAP_ALIGN. Commit 9f94db4c7eaa ("mm/sparse: check memmap alignment for compound_info_has_mask()") added a check for that requirement and exposed the unit mismatch on systems such as QEMU virt, where the DRAM base is not aligned to MAX_FOLIO_NR_PAGES * PAGE_SIZE. Here is the log: [ 0.000000][ C0] ------------[ cut here ]------------ [ 0.000000][ C0] WARNING: mm/sparse.c:365 at sparse_init+0x58a/0x6fe, CPU#0: swapper/0 [ 0.000000][ C0] Modules linked in: [ 0.000000][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc3-g1d8304bdd65f #2 PREEMPT [ 0.000000][ C0] Hardware name: riscv-virtio,qemu (DT) [ 0.000000][ C0] epc : sparse_init+0x58a/0x6fe [ 0.000000][ C0] ra : sparse_init+0x58a/0x6fe [ 0.000000][ C0] epc : ffffffff86851c88 ra : ffffffff86851c88 sp : ffffffff88807a30 [ 0.000000][ C0] gp : ffffffff8a3bf240 tp : ffffffff88842080 t0 : ff600000ffab6000 [ 0.000000][ C0] t1 : 000000017fab6000 t2 : 65203a6573726363 s0 : ffffffff88807bc0 [ 0.000000][ C0] s1 : 000000000e000000 a0 : 0000000000000007 a1 : 0000000000000000 [ 0.000000][ C0] a2 : 0000000000000002 a3 : ffffffff86851c88 a4 : 0000000000000000 [ 0.000000][ C0] a5 : ffffffff88843080 a6 : 0000000000000003 a7 : 0000000000000000 [ 0.000000][ C0] s2 : ff60000000000000 s3 : 0040000000000000 s4 : 0004000000000000 [ 0.000000][ C0] s5 : ffffffff8a4d92e0 s6 : ff600000ffab55e0 s7 : ffffffff88384d00 [ 0.000000][ C0] s8 : 0000000000000003 s9 : ffffffff88384cc1 s10: ffffffff88384cc0 [ 0.000000][ C0] s11: ffffffff8a4daae0 t3 : ffffffff915e8b20 t4 : ffffffff915e8b20 [ 0.000000][ C0] t5 : ffffffff915e8b20 t6 : ffffffff915e8bc8 ssp : 0000000000000000 [ 0.000000][ C0] status: 0000000200000100 badaddr: ffffffff86851c88 cause: 0000000000000003 [ 0.000000][ C0] [<ffffffff86851c88>] sparse_init+0x58a/0x6fe [ 0.000000][ C0] [<ffffffff8683d396>] mm_core_init_early+0x116/0x1e30 [ 0.000000][ C0] [<ffffffff86801edc>] start_kernel+0xd2/0x848 Convert MAX_FOLIO_VMEMMAP_ALIGN to the equivalent physical alignment before using it in VMEMMAP_ADDR_ALIGN. This keeps the existing round_down() logic while making the resulting vmemmap base satisfy the mask-alignment requirement.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/riscv/mm/init.c
- What this is
- RISC-V ARCHITECTUREMAINTAINERS section matched on arch/riscv/ · linux-riscv@lists.infradead.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/riscv
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.1 | 7.1.8 | 11ad86830a78 |
| 7.1 | 7.2 | 45ebe4540817 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is set during early boot in arch/riscv/mm/init.c setup_bootmem()/sparse_init(), and runtime impact is reached through local memory-management syscalls (mmap, page faults, compound folio allocation) invoking compound_head(); no network, adjacent-network, or remote protocol path exists.
- AC:LAttack complexity, low
- On affected RISC-V 64 kernels with HUGETLB/HVO enabled (RISC-V defconfig) and DRAM bases such as QEMU virt where phys_ram_base is not aligned to MAX_FOLIO_NR_PAGES*PAGE_SIZE, the wrong vmemmap_start_pfn and misaligned pfn_to_page(0) occur deterministically every boot without races or attacker-uncontrollable layout.
- PR:LPrivileges required, low
- The broken vmemmap alignment is established automatically at boot before any credentials exist; once running, an unprivileged local user can trigger compound folio allocation and freeing (anonymous mmap, THP, hugetlbfs) that exercise mask-based compound_head() with no capability or namespace gate.
- UI:NUser interaction, none
- No victim interaction is required beyond normal operation of an already-affected system; the attacker does not need another user to mount filesystems, open devices, or perform discretionary actions to reach the broken compound-page paths.
- S:UScope, unchanged
- Impact is kernel memory and page-metadata corruption within the host kernel security authority; it does not cross a VM, hypervisor, IOMMU/DMA, or sandbox boundary into a separate security domain.
- C:HConfidentiality impact, high
- Misaligned pfn_to_page(0) breaks compound_info mask decoding so compound_head() can map tail struct pages to incorrect heads, enabling out-of-bounds reads of adjacent kernel page metadata and folio contents through routine MM operations (get_user_pages, compaction, isolation).
- I:HIntegrity impact, high
- Resolving the wrong compound head corrupts folio refcount, mapping, and LRU state and directs kernel read/write operations to unintended physical pages, providing a defensible arbitrary kernel-memory corruption primitive leveragable for privilege escalation.
- A:HAvailability impact, high
- Incorrect compound_head() resolution can oops or panic the kernel during page isolation, compaction, THP, hugetlb, and I/O pin paths; sparse_init() VM_WARN_ON_ONCE on standard QEMU virt confirms the alignment violation is real on common RISC-V deployments.