Linux Kernel NULL Pointer Dereference Vulnerability in Memory Control Group Management

A vulnerability allowing a NULL pointer dereference has been identified in the Linux kernel's memory control group (memcg) management. This issue arises in the 'obj_stock_flush_required' function, where the 'cached_objcg' pointer can be reset between the check and the dereference, leading to a data race condition. The vulnerability was reported by the Kernel Concurrency Sanitizer (KCSAN) and is present in the Linux kernel stable tree.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a crash or undefined behavior in the kernel.

Reproduction

The vulnerability can be reproduced by using the 'syz-executor' tool, which is part of the syzkaller fuzzer. This tool can be used to generate and execute random system calls, triggering the race condition in the 'obj_stock_flush_required' function.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version available in the Linux kernel stable tree.