CVE-2026-80718

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()<br /> <br /> In pcpu_create_chunk(), nr_pages is the total contiguous backing<br /> allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()<br /> uses it to set chunk-&gt;populated, whose size is pcpu_unit_pages, bitmap. <br /> Since bit N in chunk-&gt;populated means page offset N inside every unit is<br /> backed. When nr_units &gt; 1, the function writes beyond chunk-&gt;populated. <br /> Fix it by using chunk-&gt;nr_pages.<br /> <br /> It also fixes the global pcpu_nr_empty_pop_pages accounting, since<br /> pcpu_balance_free() only iterates up to chunk-&gt;nr_pages.<br /> <br /> Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk-&gt;populated bitmap<br /> properly") introduced the bitmap overflow issue. Later, commit<br /> b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and<br /> chunk-&gt;nr_populated") added pcpu_nr_empty_pop_pages and caused the<br /> accounting issue.