Executive brief
The Linux kernel's dm-flakey device mapper module corrupts the zero page when its "corrupt bio writes" testing feature is enabled. This causes userspace programs to crash because memory allocation functions (like glibc's calloc) assume memory returned by mmap is zeroed; corruption of the zero page breaks this assumption and programs receive non-zeroed memory causing malfunctions and crashes.
Technical details
The vulnerability exists in the dm-flakey driver's corrupt_bio_data() function, which intentionally corrupts I/O operations for testing purposes. When zeroing a block device range via __blkdev_issue_zero_pages, the kernel uses a single shared ZERO_PAGE(0) for efficiency. The dm-flakey corruption logic failed to detect and skip this shared zero page, causing it to corrupt the page's contents. This corruption propagates to all callers expecting zeroed memory. The fix adds a check to detect and skip corruption of ZERO_PAGE(0) by comparing the page pointer before attempting corruption. Patches were committed in January 2023 and backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions (fix backported to many stable branches from 2.6.11 through 6.x series)
Timeline
- 2023-01-22: disclosed
- 2023-03-10: patched: Fix backported to stable branches
- 2025-12-30: advisory