Linux Kernel CVE-2026-80582

Exploitation requires local access to a system running an affected Linux kernel version with DRM support compiled in and a shmem-backed GPU driver active (such as virtio-gpu, lima, or panfrost - drivers using drm_gem_shmem_object). The attacker must be able to open and mmap DRM device nodes, which on most Linux distributions requires membership in the 'video' or 'render' group or equivalent privilege - a standard desktop user often qualifies, but a restricted service account or container without device access does not. Transparent Huge Pages must be enabled (the kernel default), as the ->huge_fault handler is only invoked when THP is active. Exploitation is strictly local - there is no network attack surface. Key limiting factors: local access only (AV:L per CVSS), requires DRM device group membership, requires THP enabled, requires an active shmem-based DRM driver, not triggerable on headless servers without DRM hardware or drivers loaded.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation with claimed full impact across all three pillars. The local attack vector (AV:L) and low-privilege requirement (PR:L) meaningfully constrain the attacker population compared to network-exposed flaws - exploitation is limited to users who can open DRM device nodes, which on most distributions requires membership in the 'video' or 'render' group. EPSS data was not provided, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, both of which reduce urgency compared to the raw CVSS score. The primary technically confirmed impact is kernel assertion failure causing a system crash (A:H); the C:H and I:H ratings are plausible for a PMD out-of-bounds mapping - a process could theoretically access or write to adjacent memory before the crash - but these impacts are inferred from the vulnerability class, not confirmed by a vendor advisory or POC. Environments with multi-tenant or containerized GPU workloads where untrusted users have DRM device access present the highest realistic exposure; standard single-user desktop or headless server deployments without DRM-enabled drivers are unaffected. The SSVC posture is: exploitation status 'none', automatable 'no' (local vector), technical impact 'total' if worst-case memory access is achieved. Overall, this is a genuine medium-high priority for kernel maintainers and DRM-enabled multi-user environments, but does not warrant emergency response absent confirmation of C/I impacts.

A local user with membership in the 'video' or 'render' group on an affected kernel opens a DRM shmem-backed buffer object and maps it in a way that triggers the ->huge_fault handler with a huge page that extends past the VMA's end boundary. When the process subsequently calls fork(), copy_pmd_range() encounters the malformed PMD mapping and the kernel fires VM_BUG_ON_VMA(), crashing the system; in a more targeted scenario, the window between PMD installation and the crash could be exploited to read or write memory outside the intended VMA region. No public proof-of-concept exploit has been identified at time of analysis.