Linux Kernel NULL Pointer Dereference Vulnerability in Watch Queue Error Cleanup

A vulnerability in the Linux kernel's watch queue error cleanup process can lead to a NULL pointer dereference. In the function watch_queue_set_size(), the error handling code fails to consider that the __free_page() function cannot process a NULL pointer when freeing buffer pages. This oversight can cause a NULL pointer dereference, as reported by the Kernel Address Sanitizer (KASAN). The issue arises in the error cleanup phase when allocated pages are being freed, creating a potential vulnerability.

Impact

Exploitation of this vulnerability causes a NULL pointer dereference, leading to a crash of the affected kernel process.