In the Linux kernel, the following vulnerability has been resolved:

dm-stats: fix a crash if allocation of per-cpu data fails

If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.

This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a affected < c3f211b7a277dd404b4e7d23095be964b5b46a27
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a affected < 74210fa072960a18bb0eead487585452af722e4f
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a affected < 0c8f7870ed3ebd512f090d7714cc2c556b9e5c75
fd2ed4d252701d3bbed4cd3e3d267ad469bb832a affected < cc87e26d9cce22061dc21e51e11afef29dbbc36a
Linux Linux affected
Version Status Constraints
3.12 affected —
0 unaffected < 3.12
6.12.109 unaffected ≤ 6.12.*
6.18.50 unaffected ≤ 6.18.*
7.2.4 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0c8f7870ed3ebd512f090d7714cc2c556b9e5c75 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/74210fa072960a18bb0eead487585452af722e4f cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/c3f211b7a277dd404b4e7d23095be964b5b46a27 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/cc87e26d9cce22061dc21e51e11afef29dbbc36a cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-80963 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-80963 cve-icon
History

Sat, 12 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_stat_free. dm_stat_free does "for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);", which crashes with NULL pointer dereference if s->stat_percpu[cpu] is NULL. This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before using it.
Title dm-stats: fix a crash if allocation of per-cpu data fails
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:42:29.172Z

Reserved: 2026-08-26T14:34:25.810Z

Link: CVE-2026-80963

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:02.220

Modified: 2026-09-11T20:19:02.220

Link: CVE-2026-80963

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:29Z

Links: CVE-2026-80963 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses