Executive brief
A vulnerability in the Linux kernel's support for i.MX processors could allow a local user to cause a system crash. The issue occurs when the system incorrectly handles specific hardware configuration tables during the startup of remote processors. This could lead to a denial-of-service, impacting the availability of devices using these specific chips.
Technical details
A vulnerability in the imx_rproc driver of the Linux kernel stems from an incorrect logic in imx_rproc_elf_find_loaded_rsc_table(). When a device tree contains an 'rsc-table' entry, the driver may return a non-NULL pointer even if the current firmware does not actually provide a resource table (rproc->table_ptr is NULL). The remoteproc core then misinterprets this as a valid table, leading to a null pointer dereference or similar memory corruption that triggers a kernel crash. This is a local attack vector requiring low privileges to trigger firmware loading/initialization. Patches have been released across multiple stable kernel branches including 5.15, 6.1, 6.6, 6.12, 6.18, and 6.19.
Affected products
- Linux Linux Kernel 5.15.168 to 5.15.202, 6.1.113 to 6.1.165, 6.6.57 to 6.6.128, 6.11.4 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-29: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-13: advisory: NIST initial analysis completed
References
- https://git.kernel.org/stable/c/198c629bd03863591f3fbf5ce8ff974a33f13dc9
- https://git.kernel.org/stable/c/26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d
- https://git.kernel.org/stable/c/500778df9e4c313190368908ff40c23948508e97
- https://git.kernel.org/stable/c/65379adf7d231c930572db45933ff4538f4c5128
- https://git.kernel.org/stable/c/91baf24d972ea3c04a75dd18821c03d223c0dbc0
- https://git.kernel.org/stable/c/9bd98d088f47153a81a6ec8162b4415c64aa7f39
- https://git.kernel.org/stable/c/fcec79b6a3649ae7b1f659267602ca402c240d6e