In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive/spapr: correct bitmap allocation size
kasan detects access beyond the end of the xibm->bitmap allocation:
BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read of size 8 at addr c00000001d1d0118 by task swapper/0/1
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28 Call Trace: [c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable) [c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710 [c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354 [c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0 [c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140 [c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260 [c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450 [c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118 [c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac [c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640 [c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0 [c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64
Allocated by task 0: kasan_save_stack+0x34/0x70 __kasan_kmalloc+0xb4/0xf0 __kmalloc+0x268/0x540 xive_spapr_init+0x4d0/0x77c pseries_init_irq+0x40/0x27c init_IRQ+0x44/0x84 start_kernel+0x2a4/0x538 start_here_common+0x1c/0x20
The buggy address belongs to the object at c00000001d1d0118 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of 8-byte region [c00000001d1d0118, c00000001d1d0120)
The buggy address belongs to the physical page: page:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480 raw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc ^ c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc
This happens because the allocation uses the wrong unit (bits) when it should pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small numbers of bits, the allocated object can be smaller than sizeof(long), which results in invalid accesses.
Use bitmap_zalloc() to allocate and initialize the irq bitmap, paired with bitmap_free() for consistency.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-develUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-coreUpgrade libperfUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-docUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade rtlaUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-develUpgrade kernel-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade kernel-rt-64k-coreUpgrade kernel-toolsUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade rvUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-64kUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-64k-debug-coreUpgrade kernel-rtUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64kUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-64k-debug-develUpgrade kernelUpgrade kernel-64k-coreUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 26, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Feb 26, 2025 |
| Rocky_linux | — | Upgrade python3-perfUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade rtlaUpgrade kernel-debug-uki-virtUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-debug-coreUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade kernelUpgrade rvUpgrade kernel-rt-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade libperf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-tools-libsUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modules | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-oracleUpgrade linux-aws-5.15Upgrade linux-azure-5.15Upgrade linux-lowlatencyUpgrade linux-realtimeUpgrade linux-raspiUpgrade linux-hwe-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-nvidiaUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-azureUpgrade linux-gcp-5.15Upgrade linux-azure-fde-5.15Upgrade linux-gkeopUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gkeUpgrade linux-awsUpgrade linux-riscv-5.15Upgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-ibmUpgrade linux-gcp | Mar 19, 2025 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub