Executive brief
A vulnerability in the Linux kernel's process creation mechanism could allow a local user to cause system instability or potentially gain unauthorized access. The issue occurs when the system fails to create a new process and incorrectly attempts to release internal locks that were never actually held. This can lead to a kernel crash or other unpredictable behavior, impacting the overall reliability and security of the operating system.
Technical details
A flaw was found in the Linux kernel's `copy_process()` function within `kernel/fork.c`. When `futex_hash_allocate_default()` fails, the code jumps to the `bad_fork_core_free` error label. This label attempts to release `tasklist_lock` and `siglock`, despite the fact that these locks have not yet been acquired at that stage of the process creation. This incorrect lock management can lead to kernel state corruption or deadlocks. The fix involves redirecting the error path to `bad_fork_cancel_cgroup`, which correctly cleans up resources without attempting to release unheld locks. The vulnerability is reachable by a local attacker capable of triggering process creation failures.
Affected products
- Linux Linux Kernel 6.16 to 6.16.10
Timeline
- 2025-09-18: patched: Initial patch authored by Sebastian Andrzej Siewior
- 2025-10-15: disclosed: CVE published