Executive brief
A vulnerability in the Linux kernel's block storage layer could allow a local user to cause a system crash. The issue occurs when the system fails to properly handle memory mapping for data integrity checks, leading to a 'null pointer dereference' that halts the operating system. This primarily impacts system availability and could disrupt operations on affected servers or workstations.
Technical details
A vulnerability exists in the bio_integrity_map_user() function within the Linux kernel's block layer (block/bio-integrity.c). The root cause is the improper handling of return values from pin_user_pages_fast(); when this function only partially succeeds in pinning requested pages, bio_integrity_map_user() continues execution and passes unpinned (null) page addresses to bvec_from_pages(). This results in a null pointer dereference and a general protection fault (Oops). An attacker with local access could potentially trigger this condition to cause a Denial of Service (DoS). The issue has been resolved by adding checks to ensure all requested memory is pinned, or otherwise unpinning partial results and returning -EFAULT. Fixes are available in stable kernel branches including 6.12.92, 6.18.34, and 7.0.11.
Affected products
- Linux Linux 6.8 to 7.0.11
Timeline
- 2026-05-12: patched: Initial fix commit authored
- 2026-07-19: disclosed: CVE published