Bug 2524469 (CVE-2026-80582)

Summary: CVE-2026-80582 kernel: drm/shmem_helper: Check VMA boundaries for PMD mappings
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `drm/shmem_helper` component. This vulnerability arises from insufficient boundary checks when handling large memory pages. An attacker could potentially trigger an attempt to map memory outside its designated area. This improper memory handling could lead to a system crash, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-26 14:57:58 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/shmem_helper: Check VMA boundaries for PMD mappings

In the ->huge_fault handler do not install a PMD huge page
mapping if the huge page exceeds the boundaries of the VMA.

All other ->huge_fault handlers have similar checks and the
resulting mapping will trigger a VM_BUG_ON_VMA() if it ever
reaches copy_pmd_range().
Comment 1 gkamathe 2026-08-27 10:08:17 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082615-CVE-2026-80582-b4a4@gregkh/T