Listen to this Post
This vulnerability is a NULL pointer dereference (CWE-476) in the Linux kernel’s NUMA (Non-Uniform Memory Access) initialization code. During system boot, the `of_numa_init()` function parses device tree nodes to set up memory architecture. A logic bug exists between its sub-functions, `of_numa_parse_cpu_nodes()` and of_numa_parse_memory_nodes(). The `numa_nodes_parsed` bitmask is correctly updated for nodes containing CPUs but is not updated for memory-only nodes (nodes without CPUs). Consequently, these memory-only nodes remain uninitialized. Later, when the kernel’s `free_area_init()` function attempts to access the `NODE_DATA()` structure for these uninitialized nodes, it triggers a NULL pointer dereference, causing a kernel panic and a complete system halt during boot.
Platform: Linux Kernel
Version: Affects multiple
Vulnerability : NULL Pointer Dereference
Severity: Medium
date: 2025-10-01
Prediction: Already Patched
What Undercode Say:
qemu-system-aarch64 -cpu host -nographic -m 4G -smp 1 -machine virt,accel=kvm,gic-version=3,iommu=smmuv3 -object memory-backend-ram,size=2G,id=mem0 -object memory-backend-ram,size=2G,id=mem1 -numa node,nodeid=0,memdev=mem0 -numa node,nodeid=1,memdev=mem1 -kernel $IMAGE -hda $DISK -append "console=ttyAMA0 root=/dev/vda rw earlycon"
// of_numa_parse_cpu_nodes updates mask: node_set(nid, numa_nodes_parsed); // of_numa_parse_memory_nodes should update mask for memory-only nodes, but didn't.
How Exploit:
The vulnerability is triggered during system boot on affected kernels running on hardware or virtual machines with a specific NUMA configuration. An attacker with local access cannot arbitrarily exploit this flaw to execute code or escalate privileges. The exploit condition is met when the system has one or more memory-only NUMA nodes (nodes defined with memory but no CPUs). During kernel initialization, the unhandled node leads to a panic, resulting in a permanent Denial of Service (DoS) as the system fails to boot.
Protection from this CVE
Apply kernel updates from your Linux distribution vendor. Major distributions like SUSE, Oracle Linux, and Amazon Linux have released patches. The fix ensures the `numa_nodes_parsed` bitmask is properly updated for all memory nodes during initialization.
Impact
The impact is a high-availability loss, causing a complete boot failure (kernel panic) on systems with memory-only NUMA nodes. This leads to a permanent Denial of Service (DoS). Confidentiality and integrity are not impacted. The attack vector is local, requiring no user interaction, but the system must have a specific, non-standard NUMA configuration to be vulnerable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
