Executive brief
A vulnerability in the Linux kernel's Netronome Flow Processor (NFP) driver could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation failures during network control message processing. This results in a system crash (kernel panic), impacting the availability of the server or workstation.
Technical details
A NULL pointer dereference exists in the Netronome Flow Processor (NFP) driver within the BPF component. The vulnerability is located in the nfp_bpf_cmsg_alloc() function in drivers/net/ethernet/netronome/nfp/bpf/cmsg.c, which failed to check the return value of nfp_app_ctrl_msg_alloc(). If memory allocation fails, the subsequent call to skb_put() dereferences a NULL pointer. A local attacker with sufficient privileges to trigger BPF map operations on NFP hardware could exploit this to cause a kernel panic (Denial of Service). The issue has been resolved by adding the necessary NULL check in the allocation path.
Affected products
- Linux Linux Kernel 4.16 to 6.1.130, 6.2 to 6.6.80, 6.7 to 6.12.17, 6.13 to 6.13.5, 6.14-rc1 to 6.14-rc3
Timeline
- 2025-03-12: disclosed
- 2025-03-12: advisory
- 2025-03-07: patched
References
- https://git.kernel.org/stable/c/1358d8e07afdf21d49ca6f00c56048442977e00a
- https://git.kernel.org/stable/c/29ccb1e4040da6ff02b7e64efaa2f8e6bf06020d
- https://git.kernel.org/stable/c/878e7b11736e062514e58f3b445ff343e6705537
- https://git.kernel.org/stable/c/897c32cd763fd11d0b6ed024c52f44d2475bb820
- https://git.kernel.org/stable/c/924b239f9704566e0d86abd894d2d64bd73c11eb
- https://git.kernel.org/stable/c/bd97f60750bb581f07051f98e31dfda59d3a783b
- https://git.kernel.org/stable/c/d64c6ca420019712e194fe095b55f87363e22a9a