Executive brief
The Linux kernel contains a NULL pointer dereference vulnerability in the vmalloc memory management code. An attacker or buggy code path that passes an invalid address to the is_vm_area_hugepages() function can trigger a kernel crash, causing a denial of service to the entire system.
Technical details
The vulnerability is a NULL pointer dereference in the is_vm_area_hugepages() function in include/linux/vmalloc.h. The function calls find_vm_area(addr) which can return NULL if the given address is not a valid vmalloc area, but the code immediately dereferences the returned pointer without checking for NULL. This causes a kernel crash when an invalid address is passed. The fix adds a NULL check before dereferencing the pointer. The vulnerability requires the CONFIG_HAVE_ARCH_HUGE_VMALLOC kernel configuration option to be enabled, and can be triggered by any code path that calls is_vm_area_hugepages() with an invalid address.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (all branches)
Timeline
- 2026-08-15: disclosed
- 2026-05-29: patched: Upstream fix authored and committed