Description
In the Linux kernel, the following vulnerability has been resolved:
powerpc: Don't try to copy PPR for task with NULL pt_regs
powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which
from my (arguably very short) checking is not commonly done for other
archs. This is fine, except when PF_IO_WORKER's have been created and
the task does something that causes a coredump to be generated. Then we
get this crash:
Kernel attempted to read user page (160) - exploit attempt? (uid: 1000)
BUG: Kernel NULL pointer dereference on read at 0x00000160
Faulting instruction address: 0xc0000000000c3a60
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries
Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod
CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88
Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries
NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0
REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+)
MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER: 200400f8
...
NIP memcpy_power7+0x200/0x7d0
LR ppr_get+0x64/0xb0
Call Trace:
ppr_get+0x40/0xb0 (unreliable)
__regset_get+0x180/0x1f0
regset_get_alloc+0x64/0x90
elf_core_dump+0xb98/0x1b60
do_coredump+0x1c34/0x24a0
get_signal+0x71c/0x1410
do_notify_resume+0x140/0x6f0
interrupt_exit_user_prepare_main+0x29c/0x320
interrupt_exit_user_prepare+0x6c/0xa0
interrupt_return_srr_user+0x8/0x138
Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL
pt_regs.
Check for a valid pt_regs in both ppc_get/ppr_set, and return an error
if not set. The actual error value doesn't seem to be important here, so
just pick -EINVAL.
[mpe: Trim oops in change log, add Fixes & Cc stable]
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.8 | 5.10.177 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.1.25-1 | — |
| Debian 13 | linux | 6.1.25-1 | — |
| Debian 12 | linux | 6.1.25-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1022.24 | — |
| Ubuntu 24.04 LTS | linux-intel +9 | No fix yet | — |
| Ubuntu 22.04 LTS | linux | 5.15.0-79.86 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1042.47 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1045.52 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1045.52.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1039.47 | — |
| Ubuntu 22.04 LTS | linux-gke +1 | 5.15.0-1039.44 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1025.30 | — |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1035.38 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1037.42 | — |
| Ubuntu 22.04 LTS | linux-lowlatency | 5.15.0-79.88 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1030.30 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1016.16 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1002.2 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1040.46 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1025.29 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1041.46~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1045.52~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1039.47~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 | 5.15.0-79.86~20.04.2 | — |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1036.39~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1037.42~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-79.88~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1016.16~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1040.46~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1038.42~20.04.2 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1036.38 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1043.48 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +10 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-gcp +4 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.275.1 | SUSE-SU-2025:03614-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.109.1 | SUSE-SU-2025:3761-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.133.1 | SUSE-SU-2025:3716-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.133.1 | SUSE-SU-2025:3716-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_31 | 1-150500.11.3.1 | SUSE-SU-2025:03615-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_45 | 1-150400.9.3.1 | SUSE-SU-2025:03628-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.275.1 | SUSE-SU-2025:03614-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_73 | 1-8.3.1 | SUSE-SU-2025:03614-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Server LTS 4.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Server LTS 4.3 | kernel-syms +3 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-syms +2 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
Advisories 7
- WID-SEC-2025-2077 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-0349 Dell Avamar und NetWorker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- SUSE-SU-2025:03615-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3761-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03628-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03614-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3716-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://git.kernel.org/stable/c/80a4200d51e5a7e046f4a90f5faa5bafd5a60c58
- https://git.kernel.org/stable/c/7624973bc15b76d000e8e6f9b8080fcb76d36595
- https://git.kernel.org/stable/c/064a1c7b0f8403260d77627e62424a72ca26cee2
- https://git.kernel.org/stable/c/01849382373b867ddcbe7536b9dfa89f3bcea60e
- https://git.kernel.org/stable/c/fd7276189450110ed835eb0a334e62d2f1c4e3be