EUVD-2026-59512
GHSA-h26r-wqjv-57jf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
AC:H reflects that exploitation requires both NVDIMM hardware in BTT mode and concurrent I/O to win the race, conditions absent from most deployments; all other metrics match the vendor vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: Handle preemption in BTT lane acquisition
BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane acquisition that can lead to silent data corruption.
The existing lane model uses a spinlock together with a per-CPU recursion count. That recursion model stopped being valid after BTT lanes became preemptible: another task can run on the same CPU, observe a non-zero recursion count, bypass locking, and use the same lane concurrently.
BTT lanes are also held across arena_write_bytes() calls. That path reaches nsio_rw_bytes(), which flushes writes with nvdimm_flush(). Some provider flush callbacks can sleep, making a spinlock the wrong primitive for the lane lifetime.
Replace the spinlock-based recursion model with a dynamically allocated per-lane mutex array and take the lane lock unconditionally.
Add might_sleep() to catch any future atomic-context caller.
Found with the ndctl unit test btt-check.sh.
AnalysisAI
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access with low-level privileges (AV:L/PR:L confirmed by CVSS vector) on a Linux host where NVDIMM (Non-Volatile DIMM) hardware is physically installed and a namespace on that device has been explicitly configured in BTT (Block Translation Table) mode using ndctl - a non-default, administrator-provisioned persistent memory configuration absent from standard virtual machines and most bare-metal servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.3 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L reflects a local low-privilege exploit with high confidentiality and integrity impact - consistent with silent persistent-memory corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user on a Linux host running an unpatched kernel with NVDIMM storage configured in BTT mode initiates concurrent write-heavy I/O against the BTT device during normal workload activity. When a preemption event interrupts a task mid-lane-acquisition, a second task on the same CPU observes the non-zero recursion counter, bypasses the spinlock, and simultaneously operates on the same lane's metadata and workspace buffers, producing silent corruption of the persistent memory contents - potentially exposing data belonging to other processes or corrupting database transaction logs stored on the NVDIMM. … |
| Remediation | The primary fix is to update to a patched kernel: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 as appropriate for the running branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems with NVDIMM persistent memory configured in BTT mode, as this vulnerability only affects those deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today