Executive brief
The Linux kernel's ring-buffer self-test has a bug that can crash the system during boot. When kernel thread creation fails, the code attempts to clean up by stopping a thread handle that contains an error pointer rather than a valid thread reference, causing a kernel panic. This affects systems undergoing late initialization tests.
Technical details
The vulnerability is an incorrect pointer check in test_ringbuffer()'s cleanup loop. The code uses `!rb_threads[cpu]` to detect invalid entries, which only catches NULL pointers but misses ERR_PTR values. When kthread_run_on_cpu() fails (returning ERR_PTR(-ENOMEM) or -EINTR), the error pointer is stored in the rb_threads array. During cleanup, the non-NULL ERR_PTR passes the check and is passed to kthread_stop(), which dereferences the invalid pointer. The fix replaces the NULL check with IS_ERR_OR_NULL() macro. No user interaction or special privileges are required; the crash occurs automatically during kernel boot. A patch has been released and applied across multiple Linux kernel versions.
Affected products
- Linux Linux kernel 7.2.0-rc6 and earlier affected versions
Timeline
- 2026-09-03: disclosed
- 2026-08-19: patched: Fix applied to stable kernel branches