Executive brief
A vulnerability in the Linux kernel's filesystem management could allow a local user to cause a system crash or potentially gain unauthorized access. The issue occurs when the system attempts to retrieve specific mount information related to user and group ID mappings. This could impact the stability and security of servers or workstations running affected versions of the Linux operating system.
Technical details
An uninitialized pointer dereference vulnerability exists in the statmount_string() function within fs/namespace.c of the Linux kernel. When processing STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP flags, the code fails to initialize the 'offp' pointer before it is subsequently updated with a string offset. A local attacker with low privileges can trigger this flaw to cause a kernel oops (denial of service) or potentially achieve arbitrary memory corruption. The issue has been resolved in stable kernel updates by ensuring 'offp' is correctly assigned for all relevant code paths.
Affected products
- Linux Linux Kernel 6.15 to 6.17.10
Timeline
- 2025-10-13: other: Patch submitted by developer
- 2025-12-16: disclosed: CVE published