Technical Summary

The Linux kernel vulnerability involves the ipc_idr_alloc() function in the checkpoint/restore sysctl path requesting the next SysV IPC id with an open-ended upper bound, allowing allocations beyond the valid IPC ID range (ipc_mni). This causes the returned IPC id to be encoded with a truncated index, leading to removal operations targeting incorrect slots and leaving behind stale IDR entries. These stale entries can cause dereferencing of freed memory when /proc/sysvipc/shm is accessed. The root cause is that idr_alloc() is called with a zero upper bound, effectively allowing overflow beyond the valid ID range. The fix involves bounding the allocation to ipc_mni to prevent allocation beyond the valid range.