Executive brief
A vulnerability in the Linux kernel's ARM Integrator platform initialization can cause the system to crash or fail to start. This occurs because the system attempts to allocate memory before the memory management components are fully ready. While this primarily impacts system availability during the boot process, it does not directly expose customer data.
Technical details
A vulnerability in the ARM Integrator platform initialization (arch/arm/mach-versatile/integrator_cp.c) occurs when intcp_init_early calls syscon_regmap_lookup_by_compatible. This triggers of_syscon_register, which attempts to allocate memory via kmalloc before the memory management subsystem is initialized. Depending on the GCC version used for compilation, this results in either a NULL pointer dereference (Oops) or a failed initialization (-ENOMEM) that prevents sched_clock_register from being called. The fix involves moving the regmap lookup and clock registration from the early initialization phase to the standard machine initialization phase (intcp_init_of).
Affected products
- Linux Linux Kernel bdb249fce9ad4 to 90d77b30a666049ad24df463f52e5d529c44e8cd
Timeline
- 2026-05-05: other: Patch authored by Guenter Roeck
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/22c738fb51f2d8b23ddff5cc0ccb2dd685bb39d3
- https://git.kernel.org/stable/c/33ad014abec90f37dade0e00560f28864187e21a
- https://git.kernel.org/stable/c/508b1193d63b5e073a3fe103eeb785fcba2d368c
- https://git.kernel.org/stable/c/58a112b0973f6cd6bcb8c503d1ff88be411ed0f0
- https://git.kernel.org/stable/c/6624854554c4c2bdfed3559e5c11bb03b16e7bd1
- https://git.kernel.org/stable/c/812103fb6da904bd03d62cf6a9826e537318ceed
- https://git.kernel.org/stable/c/90d77b30a666049ad24df463f52e5d529c44e8cd