Executive brief
The Linux kernel's module loader did not properly validate ELF section header types before accessing section name and symbol string tables. This could allow an attacker to craft a malicious kernel module that references unvalidated memory offsets, potentially reading sensitive kernel data or triggering a kernel crash during module loading.
Technical details
This vulnerability exists in the kernel module loading code (kernel/module/main.c) where ELF section header validation was incomplete. The functions elf_validity_cache_secstrings() and elf_validity_cache_index_str() accessed the section name table (.shstrtab) and symbol string table (.strtab) headers without first validating that their type field was set to SHT_STRTAB. If a malicious ELF module had these sections marked as SHT_NULL or SHT_NOBITS instead, the sh_offset field would not have been validated by earlier checks, and dereferencing it could read arbitrary kernel memory. The fix adds explicit SHT_STRTAB type validation before caching these section headers. Attack requires the ability to load a kernel module (typically root or via vulnerable module loading mechanisms). The patch was merged upstream and backported to stable kernel series.
Affected products
- Linux Linux kernel multiple versions across 2.6.11 through 7.2 series
Timeline
- 2026-09-11: disclosed
- 2026-08-06: patched: commit 9a5ff45689329835f874cefe5174e577d141d423