In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive/spapr: correct bitmap allocation size
kasan detects access beyond the end of the xibm->bitmap allocation:
BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read of size 8 at addr c00000001d1d0118 by task swapper/0/1
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28 Call Trace: [c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable) [c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710 [c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354 [c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0 [c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140 [c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260 [c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450 [c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118 [c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac [c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640 [c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0 [c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64
Allocated by task 0: kasan_save_stack+0x34/0x70 __kasan_kmalloc+0xb4/0xf0 __kmalloc+0x268/0x540 xive_spapr_init+0x4d0/0x77c pseries_init_irq+0x40/0x27c init_IRQ+0x44/0x84 start_kernel+0x2a4/0x538 start_here_common+0x1c/0x20
The buggy address belongs to the object at c00000001d1d0118 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of 8-byte region [c00000001d1d0118, c00000001d1d0120)
The buggy address belongs to the physical page: page:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480 raw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc ^ c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc
This happens because the allocation uses the wrong unit (bits) when it should pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small numbers of bits, the allocated object can be smaller than sizeof(long), which results in invalid accesses.
Use bitmap_zalloc() to allocate and initialize the irq bitmap, paired with bitmap_free() for consistency.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade python3-perfUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade libperfUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-debugUpgrade kernel-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-rt-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade perfUpgrade kernel-rt-64k-modulesUpgrade kernel-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-64k-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-develUpgrade rtlaUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-headersUpgrade kernel-cross-headersUpgrade kernel-rt-64k-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64kUpgrade kernel-64kUpgrade kernel-toolsUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debug-develUpgrade rvUpgrade kernel-rt-debug-coreUpgrade kernel-64k-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modulesUpgrade kernelUpgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade kernel-64k-debug-develUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-64k-develUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-debugUpgrade kernel-64k-debug-coreUpgrade kernel-rtUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-core | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 26, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade rtlaUpgrade kernel-debug-uki-virtUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-develUpgrade perfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-toolsUpgrade kernel-modulesUpgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade libperfUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-debuginfoUpgrade libperf-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extra | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-azure-fde-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azure-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-lowlatencyUpgrade linux-gcp-5.15Upgrade linux-aws-5.15Upgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-gkeUpgrade linux-azureUpgrade linuxUpgrade linux-raspiUpgrade linux-hwe-5.15Upgrade linux-oracleUpgrade linux-gkeopUpgrade linux-intel-iotgUpgrade linux-riscv-5.15Upgrade linux-awsUpgrade linux-kvmUpgrade linux-ibmUpgrade linux-gcp | Mar 19, 2025 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub