Executive brief
A vulnerability in the Linux kernel's block device management could allow a local user to crash the system. By attempting to mount an internal kernel filesystem that is not intended for public use, a user can trigger a system failure (NULL pointer dereference). This results in a complete denial of service, requiring a system reboot to restore operations.
Technical details
A vulnerability exists in the Linux kernel block layer where the bdev pseudo-filesystem is incorrectly exposed to userspace mounting. The bdev filesystem is an internal kernel component that uses 'empty_iops' for its inode operations, meaning many function pointers in the inode_operations structure are NULL. If a userspace process attempts to mount this filesystem and subsequently access files (e.g., via move_mount() or path_openat()), the kernel attempts to dereference these NULL pointers, leading to a supervisor instruction fetch fault and a kernel oops. The fix involves unregistering the filesystem from the global registry to prevent userspace from attempting to mount it.
Affected products
- Linux Linux Kernel 2.6.12 to 6.1.155
Timeline
- 2026-05-21: other: Patch authored
- 2026-07-19: disclosed: CVE published