Linux Kernel NULL Pointer Dereference Vulnerability in sk_msg_recvmsg Function

A vulnerability in the Linux kernel's socket message handling can lead to a NULL pointer dereference. This issue arises in the sk_msg_recvmsg function, particularly when sockmap redirection is used without stream parsing or verdicts. The vulnerability was introduced by a commit that changed how the end of the scatterlist is checked, failing to properly mark the end in certain cases. As a result, the function could incorrectly process socket messages, leading to a crash.

Impact

Exploitation of this vulnerability causes a kernel NULL pointer dereference, which can lead to a system crash or undefined behavior.