Executive brief
A vulnerability in the Linux kernel's Intel P-Unit mailbox driver can lead to memory corruption. This component manages communication between the operating system and the processor's power management unit. An exploit could allow a local user to crash the system or potentially gain unauthorized access to sensitive data.
Technical details
A memory corruption vulnerability exists in drivers/platform/x86/intel/punit_ipc.c within the Linux kernel. The root cause is a coding error where the address of a pointer (&punit_ipcdev) is passed to devm_request_irq instead of the pointer itself (punit_ipcdev). Consequently, when the interrupt handler intel_punit_ioc() executes, the complete() function writes to an incorrect memory location. This local attack vector requires low privileges and no user interaction. The issue has been resolved in multiple stable kernel branches including 5.15.197, 6.1.159, 6.6.119, 6.12.61, and 6.17.11.
Affected products
- Linux Linux 4.5 to 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11
Timeline
- 2025-11-21: other: Patch authored
- 2025-12-16: advisory: NVD Published Date
References
- https://git.kernel.org/stable/c/15d560cdf5b36c51fffec07ac2a983ab3bff4cb2
- https://git.kernel.org/stable/c/3e7442c5802146fd418ba3f68dcb9ca92b5cec83
- https://git.kernel.org/stable/c/46e9d6f54184573dae1dcbcf6685a572ba6f4480
- https://git.kernel.org/stable/c/9b9c0adbc3f8a524d291baccc9d0c04097fb4869
- https://git.kernel.org/stable/c/a21615a4ac6fecbb586d59fe2206b63501021789
- https://git.kernel.org/stable/c/c2ee6d38996775a19bfdf20cb01a9b8698cb0baa