In the Linux kernel, the following vulnerability has been resolved:
hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade cluster-md-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade kernel-default-baseUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-buildUpgrade dtb-lgUpgrade kernel-default-optionalUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade dtb-caviumUpgrade dtb-rockchipUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade dtb-alteraUpgrade kernel-docs-htmlUpgrade dtb-appleUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-freescaleUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade kernel-debug-vdsoUpgrade kernel-defaultUpgrade kernel-rt-extraUpgrade kernel-rt-optionalUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade kernel-source-azureUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-defaultUpgrade dtb-allwinnerUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-azureUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-defaultUpgrade dtb-exynosUpgrade kernel-rt-livepatchUpgrade kernel-default-base-rebuildUpgrade dtb-nvidiaUpgrade kernel-develUpgrade dtb-broadcomUpgrade kernel-devel-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade dtb-mediatekUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade kernel-symsUpgrade kernel-rt-livepatch-develUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade dtb-xilinxUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade kernel-64kbUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade dlm-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-64kb-optionalUpgrade dtb-amlogicUpgrade kernel-debug-livepatch-develUpgrade kernel-default-extraUpgrade dtb-socionextUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-default-develUpgrade dtb-amazonUpgrade kernel-devel-rtUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-default | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub