Executive brief
A vulnerability in the Linux kernel's file system management could allow a local user to crash the system. The issue occurs when the system attempts to release memory associated with certain files that are not properly configured. This results in a system crash (kernel panic), which can disrupt operations and lead to a denial of service for all users on the affected machine.
Technical details
A NULL pointer dereference exists in the Linux kernel's fs/buffer.c component within the try_to_free_buffers() function. The vulnerability is triggered when filemap_release_folio() is called on a folio belonging to a mapping with the AS_RELEASE_ALWAYS flag set but no release_folio operation defined. In this specific misconfiguration, folio_needs_release() returns true, but the folio lacks private buffer data, causing try_to_free_buffers() to call drop_buffers() on a NULL reference. A local attacker can exploit this to cause a kernel panic (Denial of Service). The issue has been resolved by adding a defensive check and a WARN_ON_ONCE() alert in try_to_free_buffers() to handle folios without attached buffers.
Affected products
- Linux Linux Kernel 6.1.72 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-11: other: Patch submitted by developer
- 2026-05-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1b111a69a6e33a922622bf9870e4e63fb2b649c8
- https://git.kernel.org/stable/c/42c32d7571ccd8ef32351cac506f00b0fae99fd2
- https://git.kernel.org/stable/c/727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3
- https://git.kernel.org/stable/c/b68f91ef3b3fe82ad78c417de71b675699a8467c
- https://git.kernel.org/stable/c/c1b6227555c52781178132b7a06466711855795c
- https://git.kernel.org/stable/c/c6246ca15999053d2632fbcc7b86e6eef7f077cb