In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
KASAN reports:
[ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497) [ 4.676149][ T0] Read of size 8 at addr 1fffffff85115558 by task swapper/0/0 [ 4.683454][ T0] [ 4.685638][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc3-00004-g0e862838f290 #1 [ 4.694331][ T0] Hardware name: Supermicro SYS-5018D-FN4T/X10SDV-8C-TLN4F, BIOS 1.1 03/02/2016 [ 4.703196][ T0] Call Trace: [ 4.706334][ T0] <TASK> [ 4.709133][ T0] ? dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)
after converting the type of the first argument (@nr, bit number) of arch_test_bit() from `long` to `unsigned long`[0].
Under certain conditions (for example, when ACPI NUMA is disabled via command line), pxm_to_node() can return %NUMA_NO_NODE (-1). It is valid 'magic' number of NUMA node, but not valid bit number to use in bitops. node_online() eventually descends to test_bit() without checking for the input, assuming it's on caller side (which might be good for perf-critical tasks). There, -1 becomes %ULONG_MAX which leads to an insane array index when calculating bit position in memory.
For now, add an explicit check for @node being not %NUMA_NO_NODE before calling test_bit(). The actual logics didn't change here at all.
[0] https://github.com/norov/linux/commit/0e862838f290147ea9c16db852d8d494b552d38d
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade bpftoolUpgrade kernelUpgrade kernel-develUpgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.144-127.601Upgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-headersUpgrade bpftool-debuginfo | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Jun 20, 2025 | Jun 20, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libs | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools | Feb 3, 2026 | Jan 30, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 18, 2025 |
| Ubuntu | — | Upgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linux-gcpUpgrade linuxUpgrade linux-gkeopUpgrade linux-azure-5.4Upgrade linux-intel-iotgUpgrade linux-hwe-5.4Upgrade linux-riscv-5.15Upgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-ibm-5.4Upgrade linux-iotUpgrade linux-kvmUpgrade linux-azure-5.15Upgrade linux-gcp-fipsUpgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-nvidiaUpgrade linux-aws-5.4Upgrade linux-gcp-5.15Upgrade linux-hwe-5.15Upgrade linux-fipsUpgrade linux-oracle-5.15Upgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-lowlatencyUpgrade linux-azureUpgrade linux-realtime | Jun 26, 2025 | Jun 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub