Linux Kernel TIPC NULL Pointer Dereference Vulnerability

A NULL pointer dereference vulnerability has been identified in the Linux kernel's TIPC (Transparent Inter-Process Communication) module. This issue arises in the function 'tipc_mon_reinit_self()', where a race condition can occur between two threads. One thread may disable a bearer while another is trying to reinitialize it, leading to a general protection fault. The vulnerability was reported by syzbot and is present in Linux kernel version 6.15.0-rc1.

Impact

Exploitation of this vulnerability causes a general protection fault, indicating a serious error in the kernel that could lead to a crash or instability.

Reproduction

The vulnerability can be reproduced by creating a race condition between two threads: one that enables a TIPC bearer and another that disables it immediately afterward. This can be done by scheduling a work item to delete the TIPC monitor while the reinitialization process is still ongoing, causing a NULL pointer dereference.