Executive brief
The Linux kernel's PA-RISC architecture code contains a buffer overflow vulnerability in the firmware console print function (pdc_iodc_print). Without proper bounds checking and synchronization, concurrent calls to this function could overwrite kernel memory in the shared iodc_dbuf buffer. An attacker with kernel-level or early boot access could exploit this to corrupt kernel state or execute arbitrary code.
Technical details
The vulnerability is a classic buffer overflow combined with a race condition in the pdc_iodc_print() function in arch/parisc/kernel/firmware.c. The iodc_dbuf[] static buffer (4096 bytes) was being accessed without proper length validation on the input count parameter, and concurrent access by multiple CPU cores was not properly serialized. The fix adds a bounds check (clamping count to buffer size), expands the pdc_lock spinlock critical section to protect all buffer accesses, and removes an unused iodc_retbuf buffer. The vulnerability affects PA-RISC systems running Linux kernel versions prior to the patch; the fix was backported to stable branches starting with 6.0+. Exploitation requires the ability to trigger pdc_iodc_print() calls with oversized buffers, typically reachable during early kernel boot or from privileged code paths.
Affected products
- Linux Linux Kernel prior to fix; backported to 6.0+
Timeline
- 2025-10-07: disclosed
- 2023-01-07: patched