CVE-2026-80963

Description

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_stat_free. dm_stat_free does "for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);", which crashes with NULL pointer dereference if s->stat_percpu[cpu] is NULL. This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before using it.

Is your site exposed to CVE-2026-80963?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0c8f7870ed3ebd512f090d7714cc2c556b9e5c75 https://git.kernel.org/stable/c/389a50d094e13724f5f45e6d9d6ef734c98ba291 https://git.kernel.org/stable/c/564d17573ef643c13cf6e9015124a205fa65e704 https://git.kernel.org/stable/c/74210fa072960a18bb0eead487585452af722e4f https://git.kernel.org/stable/c/9805d87d0e26c68ee69da3928e665214d2e2851a https://git.kernel.org/stable/c/c3f211b7a277dd404b4e7d23095be964b5b46a27 https://git.kernel.org/stable/c/cc87e26d9cce22061dc21e51e11afef29dbbc36a https://git.kernel.org/stable/c/e45f0b0c41139810ff395ba2f3cfca1460a5b8a6

Frequently Asked Questions

What is CVE-2026-80963? +

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_stat_free. dm_stat_free does "for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);", which crashes with NULL pointer dereference if s->stat_percpu[cpu] is NULL. This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before using it.

How do I check if I'm vulnerable to CVE-2026-80963? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.