Executive brief
A vulnerability was identified in the Linux kernel's SLIMbus regmap component, which manages communication between the operating system and hardware components like audio codecs. An error in how the system initializes this communication channel can lead to a kernel crash (paging request failure) during operations such as audio playback. This could allow a local user to cause a system crash or potentially gain unauthorized access to system memory, impacting overall system stability and security.
Technical details
A vulnerability exists in the Linux kernel's regmap SLIMbus implementation due to an incorrect bus_context pointer being passed during initialization in __devm_regmap_init_slimbus() and __regmap_init_slimbus(). The root cause is the use of an incorrect pointer argument (passing the address of the pointer instead of the pointer itself), which leads to an invalid memory access ('Unable to handle kernel paging request') when the regmap bus performs read/write operations. A local attacker could trigger this via standard system calls (e.g., ioctl for audio playback) to cause a Denial of Service (kernel panic) or potentially exploit the resulting memory corruption for privilege escalation. The issue has been resolved by correcting the bus_context argument to point to the slim_device structure.
Affected products
- Linux Linux Kernel 4.16 to 6.12.y
Timeline
- 2025-10-22: patched: Initial patch authored by Alexey Klimov
- 2025-12-08: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/02d3041caaa3fe4dd69e5a8afd1ac6b918ddc6a1
- https://git.kernel.org/stable/c/2664bfd8969d1c43dcbe3ea313f130dfa6b74f4c
- https://git.kernel.org/stable/c/434f7349a1f00618a620b316f091bd13a12bc8d2
- https://git.kernel.org/stable/c/8143e4075d131c528540417a51966f6697be14eb
- https://git.kernel.org/stable/c/a16e92f8d7dc7371e68f17a9926cb92d2244be7b
- https://git.kernel.org/stable/c/b65f3303349eaee333e47d2a99045aa12fa0c3a7
- https://git.kernel.org/stable/c/c0f05129e5734ff3fd14b2c242709314d9ca5433