Listen to this Post
How the mentioned CVE works:
A data race condition exists in the `show_numa_info()` function within the Linux kernel’s mm/vmalloc.c. When the `/proc/vmallocinfo` file is read concurrently by multiple processes, the same `seq_file` private data (m->private) is accessed without proper synchronization. One thread can be writing a heap address to `m->private` (line 4934) while another thread is simultaneously reading from it (line 4936). This concurrent read and write operation on the same non-atomic memory location leads to unpredictable behavior, potentially causing the kernel to read an invalid pointer and crash, resulting in a denial of service.
Platform: Linux Kernel
Version: Up to resolution
Vulnerability: Race Condition
Severity: Low
date: 07/25/2025
Prediction: 08/15/2025
What Undercode Say:
cat /proc/vmallocinfo
// Data Race: // CPU 0 (Read) seq_printf(m, "N%u=%lu,", node, pages); // CPU 1 (Write) m->private = (void )addr;
for i in {1..10}; do cat /proc/vmallocinfo & done
How Exploit:
Concurrent `/proc/vmallocinfo` reads.
Protection from this CVE
Patch the kernel.
Impact:
Kernel crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
