Linux Kernel RCU NULL-Pointer Dereference Vulnerability in Preemptible RCU

A vulnerability in the Linux kernel's handling of the RCU (Read-Copy-Update) mechanism can lead to a NULL-pointer dereference. This issue affects kernels built with CONFIG_PREEMPT_RCU enabled. The vulnerability arises when one CPU (CPU1) updates a task's expiration pointer in the RCU node structure without the necessary locks, allowing another CPU (CPU2) to read a stale pointer. If CPU1 sets the pointer to NULL, CPU2 may dereference it, causing a crash.

Impact

Exploitation of this vulnerability leads to a NULL-pointer dereference, causing a kernel crash.

Reproduction

To reproduce this vulnerability, use a kernel built with CONFIG_PREEMPT_RCU enabled. The issue can be triggered by manipulating the RCU task expiration pointers in a way that one CPU updates the pointer without proper locking, while another CPU reads the pointer, potentially leading to a NULL-pointer dereference.

Remediation

Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been addressed.