In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.
CVE-2023-1077
CVSS base score
7.0 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-843
Last modified
November 2, 2026
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
linux linux kernel
debian debian linux
netapp a700s firmware
netapp 8300 firmware
netapp 8700 firmware
netapp a400 firmware
netapp c400 firmware
netapp h300s firmware
netapp h500s firmware
netapp h700s firmware
References
- git.kernel.org Mailing List, Patch
- lists.debian.org Mailing List, Third Party Advisory
- lists.debian.org Mailing List
- security.netapp.com Third Party Advisory
- git.kernel.org Mailing List, Patch
- lists.debian.org Mailing List, Third Party Advisory
- lists.debian.org Mailing List
- security.netapp.com Third Party Advisory
- cert-portal.siemens.com
- cert-portal.siemens.com