Description
In the Linux kernel, the following vulnerability has been resolved:
um: init cpu_tasks[] earlier
This is currently done in uml_finishsetup(), but e.g. with
KCOV enabled we'll crash because some init code can call
into e.g. memparse(), which has coverage annotations, and
then the checks in check_kcov_mode() crash because current
is NULL.
Simply initialize the cpu_tasks[] array statically, which
fixes the crash. For the later SMP work, it seems to have
not really caused any problems yet, but initialize all of
the entries anyway.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.13 | 6.18.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.18.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | linux | 6.17.0-22.22 | USN-8177-1 |
| Ubuntu 25.10 | linux-aws +1 | 6.17.0-1012.12 | USN-8183-2, USN-8183-1 |
| Ubuntu 25.10 | linux-azure +1 | 6.17.0-1013.13 | USN-8245-1 |
| Ubuntu 25.10 | linux-azure-fde | No fix yet | — |
| Ubuntu 25.10 | linux-oracle | 6.17.0-1011.11 | USN-8183-2 |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1010.11 | USN-8177-1 |
| Ubuntu 25.10 | linux-riscv | 6.17.0-22.22.1 | — |
| Ubuntu 24.04 LTS | linux-aws-6.17 +1 | 6.17.0-1012.12~24.04.1 | USN-8183-2, USN-8183-1 |
| Ubuntu 24.04 LTS | linux-azure-6.17 | 6.17.0-1013.13~24.04.1 | USN-8245-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-22.22~24.04.1 | USN-8183-2 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1018.18 | — |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1020.20 | USN-8245-1 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1011.11~24.04.1 | USN-8183-2 |
| Ubuntu 24.04 LTS | linux-riscv +19 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-6.17 | 6.17.0-22.22.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1010.11~24.04.1 | USN-8177-2 |
Advisories 6
- WID-SEC-2026-0119 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8183-2 linux-aws, linux-aws-6.17, linux-hwe-6.17, linux-oracle, linux-oracle-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8183-1 linux-gcp, linux-gcp-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8245-1 linux-azure, linux-azure-6.17, linux-oem-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8177-2 linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8177-1 linux, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026