Linux kernel drm_gem_shmem: PMD huge-page fault can map past the VMA end and trip VM_BUG_ON

CVE-2026-80582NVIDIA / GPU stackcurated

Impact

The ->huge_fault handler in the DRM shared-memory GEM helper installed a PMD-sized mapping without checking that the huge page fits inside the VMA, so a local user who mmaps a shmem-backed GEM buffer at the right size and offset can create a mapping that extends past the end of the VMA. The record describes the consequence as a VM_BUG_ON_VMA() firing in copy_pmd_range(), i.e. a kernel BUG on the next fork of that address space - an oops or panic on the node rather than a controlled escape. NVD scores it 7.8 with confidentiality and integrity impact as well, but nothing in the record backs a read or write primitive beyond the out-of-bounds mapping itself. Reachability is narrow: this helper is used by shmem-backed DRM drivers such as virtio-gpu, not by the TTM-based amdgpu path or the out-of-tree NVIDIA driver, so on most bare-metal GPU hosts the exposed surface is a guest running virtio-gpu, not the accelerator itself.

Who can reach it

Local user who can open a DRM device node backed by drm_gem_shmem and mmap a GEM buffer - typically any tenant inside a VM with virtio-gpu, or any local user with render-node access. No authentication beyond device permissions, no remote path. Not reachable at all on hosts that load no shmem-backed DRM driver.

What to do

Pick up a stable kernel containing the two linked commits; there is no runtime mitigation short of denying DRM device access to untrusted local users. Applying it means rebooting each node into the new kernel, so schedule it with normal GPU-node drain-and-reboot maintenance rather than treating it as urgent - the described impact is a local crash, and on hosts with no shmem-backed DRM driver loaded the code is never entered.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80582 https://git.kernel.org/stable/c/12803e89a1e593fd1e784dfe7453f5e392ccaff2 https://git.kernel.org/stable/c/617bbd08714857c1613d7c550d43a9092ec0fb97

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.