In the Linux kernel, the following vulnerability has been resolved:
ARM: 9381/1: kasan: clear stale stack poison
We found below OOB crash:
[ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0 [ 33.455515] [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.1.25-mainline #1 [ 33.456880] Hardware name: Generic DT based system [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.459072] dump_stack_lvl from print_report+0x158/0x4a4 [ 33.459863] print_report from kasan_report+0x9c/0x148 [ 33.460616] kasan_report from kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range from memset+0x20/0x3c [ 33.462157] memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.463064] refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354 [ 33.465029] do_idle from cpu_startup_entry+0x20/0x24 [ 33.465769] cpu_startup_entry from rest_init+0xf0/0xf4 [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18 [ 33.467397] [ 33.467644] The buggy address belongs to stack of task swapper/0/0 [ 33.468493] and is located at offset 112 in frame: [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec [ 33.469917] [ 33.470165] This frame has 2 objects: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [ 33.471294] [ 33.472095] The buggy address belongs to the physical page: [ 33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03 [ 33.473944] flags: 0x1000(reserved|zone=0) [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001 [ 33.475656] raw: 00000000 [ 33.476050] page dumped because: kasan: bad access detected [ 33.476816] [ 33.477061] Memory state around the buggy address: [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978] ==================================================================
We find the root cause of this OOB is that arm does not clear stale stack poison in the case of cpuidle.
This patch refer to arch/arm64/kernel/sleep.S to resolve this issue.
From cited commit [1] that explain the problem
Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poison prior to returning.
In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code. Any instrumented functions on this critical path will leave portions of the stack shadow poisoned.
If CPUs lose context and return to the kernel via a cold path, we restore a prior context saved in __cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by functions calls between this and the actual exit of the kernel.
Thus, (depending on stackframe layout) subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console.
To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online.
From cited commit [2]
Extend to check for CONFIG_KASAN_STACK
[1] commit 0d97e6d8024c ("arm64: kasan: clear stale stack poison") [2] commit d56a9ef84bd0 ("kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK")
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.15.160-104.158Upgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-headersUpgrade perfUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-devel | Jun 12, 2024 | May 30, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 30, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 30, 2024 |
| Suse | — | Upgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-source-azureUpgrade kernel-kvmsmallUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade dtb-apmUpgrade kernel-64kb-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-amdUpgrade kernel-debug-develUpgrade dtb-mediatekUpgrade kernel-docsUpgrade kernel-debugUpgrade kselftests-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade kernel-symsUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-64kbUpgrade dtb-appleUpgrade dtb-amlogicUpgrade dtb-xilinxUpgrade gfs2-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade dtb-renesasUpgrade kernel-macrosUpgrade kernel-rt-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-hisiliconUpgrade ocfs2-kmp-azureUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade reiserfs-kmp-defaultUpgrade dtb-marvellUpgrade dlm-kmp-rtUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-azureUpgrade dtb-lgUpgrade dtb-freescaleUpgrade kernel-rt-extraUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade kernel-debug-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-azure-optionalUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade kernel-default-baseUpgrade dtb-sprdUpgrade kernel-source-vanillaUpgrade kernel-defaultUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade ocfs2-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade kernel-obs-buildUpgrade kernel-azure-extraUpgrade dtb-nvidiaUpgrade dtb-caviumUpgrade kernel-64kb-extraUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-64kb | Jun 13, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1062-intel-iotgUpgrade linux-image-5.15.0-1064-kvmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-118-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-5.15.0-1060-raspiUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-1066-gcpUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1062-nvidiaUpgrade linux-image-5.15.0-1050-gkeopUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-azure-fdeUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1067-awsUpgrade linux-image-oem-20.04cUpgrade linux-image-kvmUpgrade linux-image-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1070-azureUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1065-oracleUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-118-genericUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-118-generic-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1062-nvidia-lowlatencyUpgrade linux-image-5.15.0-1064-gkeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspiUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-5.15.0-118-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1060-ibmUpgrade linux-image-5.15.0-1070-azure-fdeUpgrade linux-image-oem-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-118-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-oracleUpgrade linux-image-generic | Aug 9, 2024 | May 30, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub