Executive brief
A vulnerability in the Linux kernel's device mapper component could allow a local user to cause a system crash. The issue occurs during specific storage management operations, such as deleting or suspending thin-provisioned volumes. This results in a complete denial of service for the affected system, potentially impacting business operations and data availability.
Technical details
A race condition exists in the dm-thin module of the Linux kernel due to the non-atomic use of RCU list functions. Specifically, the get_first_thin() function relied on a list_empty() check followed by a list_first() dereference. Because each function performs its own READ_ONCE() of the list head, a concurrent modification (such as a thin_dtr call) could empty the list between the two operations. This causes the kernel to dereference an invalid pointer, leading to a General Protection (GP) fault and system crash. The fix replaces the unsafe sequence with list_first_or_null_rcu(), which ensures a single atomic read of the list head.
Affected products
- Linux Linux Kernel 3.15.1 to 5.4.289, 5.5 to 5.10.233, 5.11 to 5.15.176, 5.16 to 6.1.124, 6.2 to 6.6.71, 6.7 to 6.12.9
Timeline
- 2025-01-07: patched: Initial patch authored
- 2025-01-21: disclosed: CVE published
References
- https://git.kernel.org/stable/c/12771050b6d059eea096993bf2001da9da9fddff
- https://git.kernel.org/stable/c/6b305e98de0d225ccebfb225730a9f560d28ecb0
- https://git.kernel.org/stable/c/802666a40c71a23542c43a3f87e3a2d0f4e8fe45
- https://git.kernel.org/stable/c/80f130bfad1dab93b95683fc39b87235682b8f72
- https://git.kernel.org/stable/c/cbd0d5ecfa390ac29c5380200147d09c381b2ac6
- https://git.kernel.org/stable/c/cd30a3960433ec2db94b3689752fa3c5df44d649
- https://git.kernel.org/stable/c/ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8