---
id: CVE-2026-80963
title: 'dm-stats: fix a crash if allocation of per-cpu data fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-stats: fix a crash if allocation of per-cpu data fails

  If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
  jumps to the "out" label and calls dm_s…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    e45f0b0c41139810ff395ba2f3cfca1460a5b8a6
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    9805d87d0e26c68ee69da3928e665214d2e2851a
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    564d17573ef643c13cf6e9015124a205fa65e704
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    389a50d094e13724f5f45e6d9d6ef734c98ba291
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    c3f211b7a277dd404b4e7d23095be964b5b46a27
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    74210fa072960a18bb0eead487585452af722e4f
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    0c8f7870ed3ebd512f090d7714cc2c556b9e5c75
  - >-
    Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a <
    cc87e26d9cce22061dc21e51e11afef29dbbc36a
  - Linux 3.12
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:47.190Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80963'
references:
  - url: 'https://git.kernel.org/stable/c/e45f0b0c41139810ff395ba2f3cfca1460a5b8a6'
  - url: 'https://git.kernel.org/stable/c/9805d87d0e26c68ee69da3928e665214d2e2851a'
  - url: 'https://git.kernel.org/stable/c/564d17573ef643c13cf6e9015124a205fa65e704'
  - url: 'https://git.kernel.org/stable/c/389a50d094e13724f5f45e6d9d6ef734c98ba291'
  - url: 'https://git.kernel.org/stable/c/c3f211b7a277dd404b4e7d23095be964b5b46a27'
  - url: 'https://git.kernel.org/stable/c/74210fa072960a18bb0eead487585452af722e4f'
  - url: 'https://git.kernel.org/stable/c/0c8f7870ed3ebd512f090d7714cc2c556b9e5c75'
  - url: 'https://git.kernel.org/stable/c/cc87e26d9cce22061dc21e51e11afef29dbbc36a'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80963.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80963'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532397'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80963'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80963'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80963.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00177
epssPercentile: 0.07145
ingestedAt: '2026-09-14T15:23:07.455Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-stats: fix a crash if allocation of per-cpu data fails

If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.

This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.

## Affected

- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < e45f0b0c41139810ff395ba2f3cfca1460a5b8a6`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < 9805d87d0e26c68ee69da3928e665214d2e2851a`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < 564d17573ef643c13cf6e9015124a205fa65e704`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < 389a50d094e13724f5f45e6d9d6ef734c98ba291`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < c3f211b7a277dd404b4e7d23095be964b5b46a27`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < 74210fa072960a18bb0eead487585452af722e4f`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < 0c8f7870ed3ebd512f090d7714cc2c556b9e5c75`
- `Linux >= fd2ed4d252701d3bbed4cd3e3d267ad469bb832a < cc87e26d9cce22061dc21e51e11afef29dbbc36a`
- `Linux 3.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80963.json)