What is CVE-2026-45880?

CVE-2026-45880 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 6.2 onward and patched in 6.6.128, 6.12.75, 6.18.14 and others. CVE-2026-45880 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-45880?

CVE-2026-45880 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-45880?

Yes, CVE-2026-45880 has been patched. Fixed versions include 6.6.128, 6.12.75, 6.18.14 and others. If you are running Linux kernel 6.2 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-45880 actively exploited?

CVE-2026-45880 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-45880

Medium

In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap() doesn't invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired after gen_pool_alloc_owner(), and memunmap_pages() will hang forever when trying to remove the PCI device. Fix it by adding the missed percpu_ref_put().

Package Linux Kernel

Published 2026-05-27

Last modified 2026-06-25

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.2 and later are affected. Fixed in 6.6.128, 6.12.75, 6.18.14, 6.19.4, 7.0 and their respective stable series.

Affected from

≥ 6.2

Fixed in

✓ 6.6.128 6.6.x ✓ 6.12.75 6.12.x ✓ 6.18.14 6.18.x ✓ 6.19.4 6.19.x ✓ 7.0

References

5 total

Kernel Git
https://git.kernel.org/stable/c/51b7181cfbedf289ce794b6d97a1c596c309ec38

Patch
Kernel Git
https://git.kernel.org/stable/c/6220694c52a5a04102b48109e4f24e958b559bd3

Patch
Kernel Git
https://git.kernel.org/stable/c/a1f4dc72efc3204db95d052058d785cad7ce755f

Patch
Kernel Git
https://git.kernel.org/stable/c/baa42b756d183a59572f3890981a3d32b8d05d40

Patch
Kernel Git
https://git.kernel.org/stable/c/e19cce88ec4c4877f4ff2469099b9cf23cc3e93e

Patch

Details

CVE ID CVE-2026-45880

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-05-27

Modified 2026-06-25

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-45880?

CVE-2026-45880 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.2 onward and has been patched in 6.6.128, 6.12.75, 6.18.14 and others. CVE-2026-45880 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-45880?

CVE-2026-45880 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-45880?

Yes. CVE-2026-45880 has been patched. Fixed versions include 6.6.128, 6.12.75, 6.18.14 and others. If you are running Linux kernel 6.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-45880 actively exploited?

No. CVE-2026-45880 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.