Description
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix mas_empty_area_rev() null pointer dereference Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with the maple state node == NULL. This will lead to a null pointer dereference when checking information in the NULL node, which is done in mas_data_end(). Avoid setting the offset if there is no node by waiting until after the maple state is checked for an empty or single entry state. A user could trigger the events to cause a kernel oops by unmapping all vmas to produce an empty maple tree, then mapping a vma that would cause the scenario described above.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
54a611b605901c7d5d05b6b8f5d04a6ceb0962aa to < 883e5d542bbdddbddeba60250cb482baf3ae2415affected54a611b605901c7d5d05b6b8f5d04a6ceb0962aa to < 6c9c7c1e63b198a8b979ad963eb21410f10ccb00affected54a611b605901c7d5d05b6b8f5d04a6ceb0962aa to < f3956791cf526540addd3295e4c1e0f0442486ccaffected54a611b605901c7d5d05b6b8f5d04a6ceb0962aa to < 955a923d2809803980ff574270f81510112be9cfaffected
Linux Linux
Default version status: affected
6.1affected0 to < 6.1unaffected6.1.94 to ≤ 6.1.*unaffected6.6.31 to ≤ 6.6.*unaffected6.8.10 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected