CVE-2024-35993
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-35993
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35993.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-35993
- Downstream
- Published
- 2024-05-20T09:47:57Z
- Modified
- 2025-10-17T06:02:54.621514Z
- Summary
- mm: turn folio_test_hugetlb into a PageType
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mm: turn foliotesthugetlb into a PageType
The current foliotesthugetlb() can be fooled by a concurrent folio split into returning true for a folio which has never belonged to hugetlbfs. This can't happen if the caller holds a refcount on it, but we have a few places (memory-failure, compaction, procfs) which do not and should not take a speculative reference.
Since hugetlb pages do not use individual page mapcounts (they are always fully mapped and use the entiremapcount field to record the number of mappings), the PageType field is available now that pagemapcount() ignores the value in this field.
In compaction and with CONFIGDEBUGVM enabled, the current implementation can result in an oops, as reported by Luis. This happens since 9c5ccf2db04b ("mm: remove HUGETLBPAGEDTOR") effectively added some VMBUGON() checks in the PageHuge() testing path.
[willy@infradead.org: update vmcoreinfo]
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6aFixed2431b5f2650dfc47ce782d1ca7b02d6b3916976f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6aFixed9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6aFixedd99e3140a4d33e26066183ff727d8f02f56bec64