CVE-2026-80685

In the Linux kernel, the following vulnerability has been resolved:

mm/util: don't read page 2 for order-1 folios in snapshot page()

snapshot page() currently reads page 2 after checking nr pages > 1, but it should only do so when nr pages > 2.

If an order-1 folio is allocated at the end of a vmemmap section, page 2 will not exist and reading it will cause a fault.

During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot page() oopsed on the page isolation path while reading an order-1 folio's page 2 from an adjacent absent section (unmapped vmemmap).

Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole).