Executive brief
The Linux kernel's parameter handling code for character string parameters can leave a parameter in an invalid NULL state if memory allocation fails during an update. This can cause a kernel crash (null pointer dereference) when the affected parameter is later accessed by kernel subsystems like zswap, disrupting system availability.
Technical details
The vulnerability exists in the param_set_charp() function in kernel/params.c, which manages kernel parameter updates via sysfs. The vulnerable code freed the old parameter value before attempting to allocate and copy the new value. If the kmalloc_parameter() call failed, the parameter remained NULL, leaving it in a corrupted state. An attacker or user can trigger this by setting a kernel parameter (e.g., zswap's compressor) before the zswap subsystem is initialized, causing kmalloc to fail. When zswap later tries to use the NULL parameter in strcmp(), a kernel NULL pointer dereference crashes the system. The fix allocates the new value first and only updates the parameter pointer after successful allocation, ensuring the parameter remains valid on failure.
Affected products
- Linux Linux kernel all versions prior to fix (available in multiple stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-07-29: patched