CVE-2026-80582: drm/shmem_helper: Check VMA boundaries for PMD mappings
Published Aug 26, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
drm/shmemhelper: Check VMA boundaries for PMD mappings
In the ->hugefault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA.
All other ->hugefault handlers have similar checks and the resulting mapping will trigger a VMBUGONVMA() if it ever reaches copypmdrange().
Affected Software
1 affected component
Linux Kernel
Event History
Aug 26, 2026
CVE Published
via MITRE·02:37 PM
Data Sourced
via MITRE·02:37 PM
Description
Data Sourced
via NVD·03:17 PM
Description
Frequently Asked Questions
1
What condition leads to the unsafe PMD mapping?
The condition occurs in the drm/shmem_helper ->huge_fault handler when it installs a PMD huge-page mapping that extends beyond the boundaries of the VMA.
2
How can an affected system show that this condition was reached?
If the resulting mapping reaches copy_pmd_range(), it triggers a VM_BUG_ON_VMA().
3
What component should be prioritized for remediation?
Prioritize the Linux kernel's DRM shmem helper handling, specifically the ->huge_fault path for PMD mappings.