Executive brief
The Linux kernel's DAX/KMEM subsystem contains a logic error in memory device removal. When a device initialization partially fails, the kernel attempts to clean up NULL pointers during removal, which can cause a system crash or undefined behavior. This affects systems using DAX (Direct Access) memory devices for persistent memory management.
Technical details
This is a null pointer dereference vulnerability in the DAX/KMEM subsystem (drivers/dax/kmem.c). When dev_dax_kmem_probe() partially succeeds (adding some memory ranges but failing on others), the failed ranges have NULL resource pointers. However, dev_dax_kmem_remove() iterates over all ranges regardless of whether they were successfully added, and attempts cleanup operations on NULL resources when remove_memory() indicates the memory was never added. The vulnerability occurs locally during device removal with no authentication required. The fix skips cleanup for ranges that were never successfully added during probe. No public exploits are known, and this is classified as an informational issue.
Affected products
- Linux Linux kernel Versions with discontiguous DAX resource support (from kernel 60e93dc097f7 onwards)
Timeline
- 2026-08-15: disclosed
- 2026-02-23: patched: Fix committed upstream; backports to stable branches completed by 2026-07-24