Description

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state. An unprivileged local user can exploit this race to escalate privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T06:16:26.350Z",
  "pubdate": "2026-08-26T06:16:26.350Z",
  "executiveSummary": "The vulnerability is a race condition arising from improper synchronization during the configuration of largepage shared memory objects via the FIOSSHMLPGCNF ioctl(2) operation. The root cause is a time-of-check to time-of-use (TOCTOU) flaw where the kernel fails to acquire the necessary rangelock before verifying if a page size has been configured for a shared memory object.\nThis vulnerability allows an unprivileged local attacker to trigger an inconsistent state within the shared memory object metadata. By executing concurrent ioctl calls, an attacker can cause conflicting page size configurations to be applied to the same object. This state corruption can be leveraged to achieve privilege escalation by manipulating memory management structures associated with the shared memory segment.\nThe flaw affects local systems and requires only unprivileged user access to the device or filesystem associated with the ioctl interface. Given the nature of the race, successful exploitation results in memory corruption, potentially allowing the execution of arbitrary code with elevated kernel privileges. This represents a significant security risk for systems utilizing this shared memory interface.",
  "technicalDetails": "The vulnerability exists within the kernel-mode handler for the FIOSSHMLPGCNF ioctl command, which is responsible for defining the page size for largepage shared memory objects. The design expectation is that this configuration occurs once, immediately upon object creation, and prior to any memory allocation. However, the implementation lacks atomic enforcement of this constraint.\nSpecifically, the handler performs a check to determine if the page size has already been configured for the target object. This check is performed without acquiring the associated rangelock (or any equivalent synchronization primitive), creating a race condition window. In a multi-threaded or multi-process environment, two concurrent callers can both execute the check simultaneously. Since neither thread has locked the object, both threads observe the object as 'unconfigured'.\nBoth threads then proceed to the configuration logic, where they may attempt to write conflicting or inconsistent page size parameters into the shared memory object structure. This race leads to a corrupted internal state where the memory management subsystem may possess mismatched metadata regarding the object's page size, offset, and memory boundaries.\nAn attacker can exploit this condition by pinning multiple threads to race the FIOSSHMLPGCNF ioctl call. By carefully timing these requests, the attacker induces a state where the kernel's memory management logic operates on invalid assumptions regarding the object's page alignment or total size. When subsequent operations (such as mmap or memory access) are performed on this corrupted object, the kernel may experience out-of-bounds access or use-after-free conditions. Because this occurs within kernel memory structures, an attacker can leverage these corrupted pointers or metadata to overwrite sensitive kernel data structures or redirect kernel execution flow. Consequently, an unprivileged user is able to escalate their privilege level to that of the kernel, bypass system security boundaries, and potentially gain full system control. The lack of proper locking mechanism is the primary failure point, as the absence of a serialized state update permits the collision of multiple configuration attempts on a shared resource."
}