Executive brief
A vulnerability in the Linux kernel's Restartable Sequences (rseq) subsystem could allow a local user to cause a system crash (segmentation fault). The issue occurs because the kernel does not properly validate or clear certain memory fields during thread registration, particularly when using older versions of the standard C library (glibc). This primarily impacts system stability and availability.
Technical details
A vulnerability exists in the Linux kernel's rseq (Restartable Sequences) registration logic. The 'rseq_cs' field, which should be initialized to zero by userspace, is not enforced or cleared by the kernel during the rseq syscall. If a process (such as one using an older glibc version that reuses rseq areas) leaves a non-zero, invalid pointer in this field, the kernel may attempt to access it upon return to userspace, resulting in a segmentation fault. The fix involves explicitly clearing the rseq_cs field during registration if it is found to be non-zero, ensuring compatibility with legacy library behaviors while preventing the crash.
Affected products
- Linux Linux Kernel 4.18 to 5.10.240, 5.11 to 5.15.189, 5.16 to 6.1.146, 6.2 to 6.6.99, 6.7 to 6.12.39, 6.13 to 6.14.9
Timeline
- 2025-03-06: other: Patch authored
- 2025-06-18: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2df285dab00fa03a3ef939b6cb0d0d0aeb0791db
- https://git.kernel.org/stable/c/3e4028ef31b69286c9d4878cee0330235f53f218
- https://git.kernel.org/stable/c/48900d839a3454050fd5822e34be8d54c4ec9b86
- https://git.kernel.org/stable/c/b2b05d0dc2f4f0646922068af435aed5763d16ba
- https://git.kernel.org/stable/c/eaf112069a904b6207b4106ff083e0208232a2eb
- https://git.kernel.org/stable/c/f004f58d18a2d3dc761cf973ad27b4a5997bd876
- https://git.kernel.org/stable/c/fd881d0a085fc54354414aed990ccf05f282ba53