In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: release page in error path to avoid BUG_ON
Consider the following sequence of events:
1. Userspace issues a UFFD ioctl, which ends up calling into shmem_mfill_atomic_pte(). We successfully account the blocks, we shmem_alloc_page(), but then the copy_from_user() fails. We return -ENOENT. We don't release the page we allocated. 2. Our caller detects this error code, tries the copy_from_user() after dropping the mmap_lock, and retries, calling back into shmem_mfill_atomic_pte(). 3. Meanwhile, let's say another process filled up the tmpfs being used. 4. So shmem_mfill_atomic_pte() fails to account blocks this time, and immediately returns - without releasing the page.
This triggers a BUG_ON in our caller, which asserts that the page should always be consumed, unless -ENOENT is returned.
To fix this, detect if we have such a "dangling" page when accounting fails, and if so, release it before returning.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.238-182.421Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 28, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernelUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-toolsUpgrade perfUpgrade kernel-tools-libsUpgrade kernel-develUpgrade python-perfUpgrade bpftool | Jul 23, 2024 | Feb 28, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Jul 17, 2024 | Feb 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 28, 2024 |
| Suse | — | Upgrade kernel-64kb-develUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade kernel-azure-baseUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-develUpgrade kernel-symsUpgrade reiserfs-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade kernel-64kbUpgrade kernel-defaultUpgrade kernel-preemptUpgrade kernel-azureUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-preempt-develUpgrade kernel-docsUpgrade kernel-azure-devel | Aug 9, 2024 | Feb 28, 2024 |
| Ubuntu | — | Upgrade linux-hweUpgrade linux-gcp-4.15Upgrade linux-gcp-5.4Upgrade linux-azure-5.4Upgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-hwe-5.4Upgrade linux-gcpUpgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-aws-hweUpgrade linux-oracleUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-azureUpgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linuxUpgrade linux-gkeopUpgrade linux-raspi | Nov 19, 2024 | Feb 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub