CVE-2025-38364 maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
Description
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations. The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption. User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least)
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 6.16 | premières → < 6.16 | 6.16 |
| Linux 6.15 | premières → < 6.15.5 | 6.15.5 |
| Linux 6.12 | premières → < 6.12.36 | 6.12.36 |
| Linux 6.6 | premières → < 6.6.99 | 6.6.99 |
| Linux | 6.1 | 6.1.146 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → dernières | Pas de correctif indiqué |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.5 → dernières | Pas de correctif indiqué |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → dernières | Pas de correctif indiqué |