In the Linux kernel, the following vulnerability has been resolved:
hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-syms-rtUpgrade dtb-mediatekUpgrade dlm-kmp-azureUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade kernel-docsUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-debug-livepatch-develUpgrade dtb-amazonUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade dtb-qcomUpgrade kernel-devel-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-sourceUpgrade kernel-64kb-optionalUpgrade kernel-azure-vdsoUpgrade dtb-xilinxUpgrade kernel-obs-qaUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-64kb-livepatch-develUpgrade dtb-amlogicUpgrade dtb-socionextUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-64kbUpgrade kernel-default-develUpgrade dtb-armUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatchUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade dtb-allwinnerUpgrade ocfs2-kmp-64kbUpgrade dtb-alteraUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-lgUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-renesasUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade kernel-defaultUpgrade kernel-develUpgrade dtb-exynosUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade dlm-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-default-optionalUpgrade reiserfs-kmp-64kbUpgrade dtb-nvidiaUpgrade dtb-freescaleUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-source-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-rt-extra | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub