Description
In the Linux kernel, the following vulnerability has been resolved:
powerpc/papr_scm: don't requests stats with '0' sized stats buffer
Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being
reported with vPMEM when papr_scm probe is being called. The panic is of the
form below and is observed only with following option disabled(profile) for the
said LPAR 'Enable Performance Information Collection' in the HMC:
Kernel attempted to write user page (1c) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on write at 0x0000001c
Faulting instruction address: 0xc008000001b90844
Oops: Kernel access of bad area, sig: 11 [#1]
<snip>
NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm]
LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm]
Call Trace:
0xc00000000941bca0 (unreliable)
papr_scm_probe+0x2ac/0x6ec [papr_scm]
platform_probe+0x98/0x150
really_probe+0xfc/0x510
__driver_probe_device+0x17c/0x230
<snip>
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception
On investigation looks like this panic was caused due to a 'stat_buffer' of
size==0 being provided to drc_pmem_query_stats() to fetch all performance
stats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn't have been called
since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused
due to missing check for 'p->stat_buffer_len' at the beginning of
papr_scm_pmu_check_events() which indicates that the NVDIMM doesn't support
performance-stats.
Fix this by introducing the check for 'p->stat_buffer_len' at the beginning of
papr_scm_pmu_check_events().
[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.18.3 – < 5.18.4 | 5.18.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.18.5-1 | — |
| Debian 13 | linux | 5.18.5-1 | — |
| Debian 12 | linux | 5.18.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | rv +75 | 5.14.0-611.5.1.el9_7 | RHSA-2025:20518 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | rv +73 | 5.14.0-611.5.1.el9_7 | ALSA-2025:20518 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | kernel | 5.14.0-611.5.1.el9_7 | RLSA-2025:20518 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.91.1 | SUSE-SU-2025:1176-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_25 | 1-150500.11.3.1 | SUSE-SU-2025:1241-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
Advisories 6
- ALSA-2025:20518 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:20518 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- SUSE-SU-2025:1176-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1241-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:20518 Moderate: kernel security update Rocky Linux Security Advisories · Nov 21, 2025