{"id":12339,"date":"2026-09-04T18:54:17","date_gmt":"2026-09-04T10:54:17","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80682"},"modified":"2026-09-04T18:54:17","modified_gmt":"2026-09-04T10:54:17","slug":"cve-2026-80682","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80682","title":{"rendered":"CVE-2026-80682 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nriscv\/mm: use physica"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>riscv\/mm: use physical alignment for vmemmap_start_pfn<\/p>\n<p>RISC-V computes vmemmap_start_pfn by rounding phys_ram_base down to<br \/>\nVMEMMAP_ADDR_ALIGN.  That alignment must therefore be expressed in the<br \/>\nphysical-address domain.<\/p>\n<p>Commit 476849b0fba4 (&#8220;riscv\/mm: align vmemmap to maximal folio size&#8221;)<br \/>\nattempted to account for the maximal folio alignment by feeding<br \/>\nMAX_FOLIO_VMEMMAP_ALIGN directly into VMEMMAP_ADDR_ALIGN.  However,<br \/>\nMAX_FOLIO_VMEMMAP_ALIGN is measured in bytes of struct page storage,<br \/>\nwhereas VMEMMAP_ADDR_ALIGN is used to align a physical address.<\/p>\n<p>The mask-based compound_info encoding requires pfn_to_page(0) to be<br \/>\nnaturally aligned to MAX_FOLIO_VMEMMAP_ALIGN.  Commit 9f94db4c7eaa<br \/>\n(&#8220;mm\/sparse: check memmap alignment for compound_info_has_mask()&#8221;) added a<br \/>\ncheck for that requirement and exposed the unit mismatch on systems such<br \/>\nas QEMU virt, where the DRAM base is not aligned to MAX_FOLIO_NR_PAGES *<br \/>\nPAGE_SIZE.<\/p>\n<p>Here is the log:<br \/>\n[    0.000000][    C0] &#8212;&#8212;&#8212;&#8212;[ cut here ]&#8212;&#8212;&#8212;&#8212;<br \/>\n[    0.000000][    C0] WARNING: mm\/sparse.c:365 at sparse_init+0x58a\/0x6fe, CPU#0: swapper\/0<br \/>\n[    0.000000][    C0] Modules linked in:<br \/>\n[    0.000000][    C0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc3-g1d8304bdd65f #2 PREEMPT<br \/>\n[    0.000000][    C0] Hardware name: riscv-virtio,qemu (DT)<br \/>\n[    0.000000][    C0] epc : sparse_init+0x58a\/0x6fe<br \/>\n[    0.000000][    C0]  ra : sparse_init+0x58a\/0x6fe<br \/>\n[    0.000000][    C0] epc : ffffffff86851c88 ra : ffffffff86851c88 sp : ffffffff88807a30<br \/>\n[    0.000000][    C0]  gp : ffffffff8a3bf240 tp : ffffffff88842080 t0 : ff600000ffab6000<br \/>\n[    0.000000][    C0]  t1 : 000000017fab6000 t2 : 65203a6573726363 s0 : ffffffff88807bc0<br \/>\n[    0.000000][    C0]  s1 : 000000000e000000 a0 : 0000000000000007 a1 : 0000000000000000<br \/>\n[    0.000000][    C0]  a2 : 0000000000000002 a3 : ffffffff86851c88 a4 : 0000000000000000<br \/>\n[    0.000000][    C0]  a5 : ffffffff88843080 a6 : 0000000000000003 a7 : 0000000000000000<br \/>\n[    0.000000][    C0]  s2 : ff60000000000000 s3 : 0040000000000000 s4 : 0004000000000000<br \/>\n[    0.000000][    C0]  s5 : ffffffff8a4d92e0 s6 : ff600000ffab55e0 s7 : ffffffff88384d00<br \/>\n[    0.000000][    C0]  s8 : 0000000000000003 s9 : ffffffff88384cc1 s10: ffffffff88384cc0<br \/>\n[    0.000000][    C0]  s11: ffffffff8a4daae0 t3 : ffffffff915e8b20 t4 : ffffffff915e8b20<br \/>\n[    0.000000][    C0]  t5 : ffffffff915e8b20 t6 : ffffffff915e8bc8 ssp : 0000000000000000<br \/>\n[    0.000000][    C0] status: 0000000200000100 badaddr: ffffffff86851c88 cause: 0000000000000003<br \/>\n[    0.000000][    C0] [] sparse_init+0x58a\/0x6fe<br \/>\n[    0.000000][    C0] [] mm_core_init_early+0x116\/0x1e30<br \/>\n[    0.000000][    C0] [] start_kernel+0xd2\/0x848<\/p>\n<p>Convert MAX_FOLIO_VMEMMAP_ALIGN to the equivalent physical alignment<br \/>\nbefore using it in VMEMMAP_ADDR_ALIGN.  This keeps the existing<br \/>\nround_down() logic while making the resulting vmemmap base satisfy the<br \/>\nmask-alignment requirement.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>riscv\/mm: use physical alignment for vmemmap_start_pfn<\/p>\n<p>RISC-V computes vmemmap_start_pfn by rounding phys_ram_base down to<br \/>\nVMEMMAP<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12339","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}