A vulnerability in the Linux kernel NSM driver allows an authenticated local attacker to execute arbitrary code by exploiting a module reference counting flaw.

The vulnerability exists because the NSM misc device fails to set the owner field in its file operations structure, causing the kernel to incorrectly track module references. A local user with low privileges can leverage this to trigger an execution of code within an unloaded module, leading to potential system compromise.

The ability to execute code within the kernel context poses a severe risk to system integrity and confidentiality. Given the CVSS score of 7.8, this flaw represents a high risk for local privilege escalation, potentially allowing an attacker to gain full administrative control over the host system, bypass security controls, and compromise sensitive data stored on the affected server.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults, which may indicate attempted exploitation of the NSM driver.

Compensating Controls: Restrict access to the /dev/nsm device file to only authorized system users and processes to minimize the attack surface.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to systems utilizing the NSM driver, particularly in multi-user environments where local privilege escalation is a primary threat. Organizations should prioritize updating the kernel to the patched versions listed above to prevent potential exploitation. If an immediate reboot for a kernel update is not feasible, restrict access to the affected device node as a temporary measure.