Technical impact
A race condition in the Linux kernel’s slab allocator is triggered when the kmalloc_nolock() function is called from a Non-Maskable Interrupt (NMI) context on single‑processor (UP) kernels where CONFIG_SMP is disabled. On such kernels, spin_trylock() is a no‑op that always succeeds, enabling the allocator to re‑enter and acquire n->list_lock while it is already held by the interrupted context. This re‑entrancy corrupts the internal slab state, leading to kernel crashes. The nature of the flaw is a kernel memory corruption bug that arises from a race condition and improper lock reuse (CWE-364).
Affected Systems
The vulnerability affects all versions of the Linux kernel built with CONFIG_SMP disabled. No specific kernel minor or patch level is listed, so any single‑CPU build derived from a source tree that has not yet integrated the patch is susceptible. This includes legacy or embedded releases that deliberately omit SMP support.
Risk and Exploitability
The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in CISA KEV. The CVSS score is 7, indicating a high severity. The likely attack vector is inferred from the description: an attacker would need to trigger an NMI event on a single‑CPU system to invoke kmalloc_nolock() from the NMI context, a scenario that is uncommon in typical production environments but possible in specialized hardware or during kernel debugging. Because the bug corrupts the core memory allocator, the potential impact is high if exploitation is achieved.
Ubuntu USN