CVE-2026-80718

CVE-2026-80718 is an out-of-bounds write in the percpu-km backend of the Linux kernel's per-CPU memory allocator: in pcpu_create_chunk(), the total contiguous backing allocation size (nr_units x pcpu_unit_pages) is passed to pcpu_chunk_populated(), which writes the chunk->populated bitmap that is sized for only one unit's pages, so any chunk spanning more than one unit (nr_units > 1) writes past the end of the bitmap. The bug is triggered locally when such multi-unit percpu-km chunks are created, and it additionally corrupts the global pcpu_nr_empty_pop_pages accounting introduced by commit b539b87fed37f. Per the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N with high confidentiality/integrity/availability), a local attacker with low privileges could potentially achieve high-impact kernel memory corruption (system compromise or crash), though no public PoC, no CISA KEV listing, and a low EPSS of 0.1% indicate no exploitation has been observed. Affected are Linux kernels containing the percpu-km changes from commits a63d4ac4ab609 and b539b87fed37f, a long-lived regression; the advisory does not specify exact affected or fixed release ranges, and only kernels using the percpu-km backend (not the default vmalloc-backed percpu path common on typical 64-bit builds) are exposed.

What to do: Apply the CVE-2026-80718 fix through your distribution's kernel update once it ships (no specific fixed version numbers are provided in the data, so check your vendor's advisory), and determine whether your kernels use the percpu-km backend rather than the default vmalloc-backed percpu allocator, as that is what determines exposure. Interim mitigation: restrict local unprivileged shell access on affected hosts, since exploitation requires local low-privileged code execution; no public PoC or in-the-wild exploitation is currently known.