In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive/spapr: correct bitmap allocation size
kasan detects access beyond the end of the xibm->bitmap allocation:
BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read of size 8 at addr c00000001d1d0118 by task swapper/0/1
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28 Call Trace: [c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable) [c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710 [c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354 [c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0 [c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140 [c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260 [c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450 [c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118 [c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac [c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640 [c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0 [c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64
Allocated by task 0: kasan_save_stack+0x34/0x70 __kasan_kmalloc+0xb4/0xf0 __kmalloc+0x268/0x540 xive_spapr_init+0x4d0/0x77c pseries_init_irq+0x40/0x27c init_IRQ+0x44/0x84 start_kernel+0x2a4/0x538 start_here_common+0x1c/0x20
The buggy address belongs to the object at c00000001d1d0118 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of 8-byte region [c00000001d1d0118, c00000001d1d0120)
The buggy address belongs to the physical page: page:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480 raw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc ^ c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc
This happens because the allocation uses the wrong unit (bits) when it should pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small numbers of bits, the allocated object can be smaller than sizeof(long), which results in invalid accesses.
Use bitmap_zalloc() to allocate and initialize the irq bitmap, paired with bitmap_free() for consistency.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-headersUpgrade kernel-modules-coreUpgrade kernel-modules-extraUpgrade kernel-debug-devel-matchedUpgrade rtlaUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-debug-modules-coreUpgrade python3-perfUpgrade kernel-64k-develUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade libperfUpgrade kernel-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-abi-stablelistsUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debugUpgrade kernel-rt-develUpgrade kernel-zfcpdump-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debugUpgrade kernel-64k-modulesUpgrade kernel-toolsUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64kUpgrade kernel-rt-64kUpgrade kernel-64k-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debugUpgrade kernel-tools-libsUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade rvUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-uki-virtUpgrade kernelUpgrade kernel-rt-modules-core | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 26, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 9, 2025 | Feb 26, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debuginfoUpgrade rtlaUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-debug-coreUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-rt-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade libperf-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modulesUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-debuginfoUpgrade rvUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-tools-libsUpgrade kernel-devel-matchedUpgrade kernel-rt | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-intel-iotgUpgrade linux-awsUpgrade linux-riscv-5.15Upgrade linux-kvmUpgrade linux-ibmUpgrade linux-gcpUpgrade linux-azure-5.15Upgrade linux-azureUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-oracleUpgrade linux-raspiUpgrade linux-azure-fde-5.15Upgrade linux-gcp-5.15Upgrade linux-gkeopUpgrade linux-lowlatency-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-realtimeUpgrade linux-aws-5.15Upgrade linux-gke | Mar 19, 2025 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub