Executive brief
A vulnerability in the Linux kernel's x86 architecture handling could allow a local user to crash the system. The issue occurs during specific process management operations (like failing to start a new process), where the system incorrectly handles memory pointers related to input/output permissions. This results in a 'kernel panic' or system crash, leading to a denial of service for all users and applications on the affected machine.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's x86 I/O port legacy (IOPL) emulation. The root cause is an inconsistency in the TIF_IO_BITMAP thread flag. Specifically, io_bitmap_exit() can invoke tss_update_io_bitmap() during a failed fork() cleanup for a task that is not the 'current' task. If the TIF_IO_BITMAP flag is set but no bitmap is actually installed (which can happen when kernel threads are created in the context of a user thread), the kernel attempts to dereference a NULL pointer. An attacker with local access can trigger this condition to cause a kernel oops/panic. Patches have been released across multiple stable kernel branches to ensure the flag is cleared during thread copying and to prevent TSS updates on non-current tasks.
Affected products
- Linux Linux Kernel 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3
Timeline
- 2025-02-26: patched: Initial fix authored by Thomas Gleixner
- 2025-07-03: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2cfcbe1554c119402e7382de974c26b0549899fe
- https://git.kernel.org/stable/c/2dace5e016c991424a3dc6e83b1ae5dca8992d08
- https://git.kernel.org/stable/c/73cfcc8445585b8af7e18be3c9246b851fdf336c
- https://git.kernel.org/stable/c/8b68e978718f14fdcb080c2a7791c52a0d09bc6d
- https://git.kernel.org/stable/c/aa5ce1485562f20235b4c759eee5ab0c41d2c220
- https://git.kernel.org/stable/c/b3b3b6366dc8eb5b22edba9adc4bff3cdacfd64c
- https://git.kernel.org/stable/c/d64b7b05a827f98d068f412969eef65489b0cf03