CVE-2024-27007
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-27007
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27007.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-27007
- Downstream
- Published
- 2024-05-01T05:29:08Z
- Modified
- 2025-10-09T06:44:34.316410Z
- Summary
- userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: change srcfolio after ensuring it's unpinned in UFFDIOMOVE
Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to srcfolio when UFFDIOMOVE fails") moved the src_folio->{mapping, index} changing to after clearing the page-table and ensuring that it's not pinned. This avoids failure of swapout+migration and possibly memory corruption.
However, the commit missed fixing it in the huge-page case.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedadef440691bab824e39c1b17382322d195e1fab0Fixeddf5f6e683e7f21a15d8be6e7a0c7a46436963ebe
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedadef440691bab824e39c1b17382322d195e1fab0Fixedc0205eaf3af9f5db14d4b5ee4abacf4a583c3c50