Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to crash the system. The issue occurs within the 'maple tree' data structure, which the kernel uses to manage memory areas. An exploit can trigger a system crash (null pointer dereference), potentially leading to a denial-of-service condition that disrupts operations and requires a reboot.
Technical details
A vulnerability exists in the Linux kernel's maple tree implementation where the MA_STATE_PREALLOC flag is not correctly managed during node allocation. In mas_preallocate(), the kernel fails to temporarily clear this flag when requesting new allocations; because the flag is intended to prevent re-allocation in bulk mode, its presence causes subsequent allocation requests to be ignored. This leads to an inconsistent state where a WARN_ON() is triggered, followed by a null pointer dereference when the kernel attempts to access nodes that were never allocated. The issue is particularly visible during vma merge retries in mmap_region(). Patches have been released for multiple stable kernel branches including 6.1, 6.6, and 6.12+.
Affected products
- Linux Linux Kernel 6.1.x, 6.2.x, 6.6.x, 6.7.x, 6.12.x, 6.13.x, 6.15.x
Timeline
- 2025-07-25: disclosed
- 2025-07-25: advisory
- 2025-07-06: patched: Initial patches committed to stable trees.
References
- https://git.kernel.org/stable/c/9e32f4700867abbd5d19abfcf698dbd0d2ce36a4
- https://git.kernel.org/stable/c/cf95f8426f889949b738f51ffcd72884411f3a6a
- https://git.kernel.org/stable/c/d69cd64bd5af41c6fd409313504089970edaf02f
- https://git.kernel.org/stable/c/e63032e66bca1d06e600033f3369ba3db3af0870
- https://git.kernel.org/stable/c/fba46a5d83ca8decb338722fb4899026d8d9ead2
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html