CVE-2026-80682

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv/mm: use physical alignment for vmemmap_start_pfn

RISC-V computes vmemmap_start_pfn by rounding phys_ram_base down to

VMEMMAP_ADDR_ALIGN. That alignment must therefore be expressed in the

physical-address domain.

Commit 476849b0fba4 ("riscv/mm: align vmemmap to maximal folio size")

attempted to account for the maximal folio alignment by feeding

MAX_FOLIO_VMEMMAP_ALIGN directly into VMEMMAP_ADDR_ALIGN. However,

MAX_FOLIO_VMEMMAP_ALIGN is measured in bytes of struct page storage,

whereas VMEMMAP_ADDR_ALIGN is used to align a physical address.

The mask-based compound_info encoding requires pfn_to_page(0) to be

naturally aligned to MAX_FOLIO_VMEMMAP_ALIGN. Commit 9f94db4c7eaa

("mm/sparse: check memmap alignment for compound_info_has_mask()") added a

check for that requirement and exposed the unit mismatch on systems such

as QEMU virt, where the DRAM base is not aligned to MAX_FOLIO_NR_PAGES *

PAGE_SIZE.

Here i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References