Linux Kernel Null Pointer Dereference Vulnerability in Block-MQ Component

A null pointer dereference vulnerability has been identified in the Linux kernel's block-mq component. This issue arises because the function blk_mq_alloc_map_and_rqs() can fail due to out-of-memory conditions, leaving a pointer uninitialized. When blk_mq_clear_rq_mapping() is subsequently called, it attempts to dereference this null pointer, leading to a crash. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a kernel crash.

Reproduction

The vulnerability can be reproduced by triggering an out-of-memory condition that causes blk_mq_alloc_map_and_rqs() to fail. This leaves the tags pointer for the current execution context index (hctx_idx) uninitialized. When blk_mq_clear_rq_mapping() is called, it dereferences the null pointer, leading to a crash.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.