In the Linux kernel, the following vulnerability has been resolved:
hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-azure-vdsoUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade kselftests-kmp-rtUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-amlogicUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade dtb-socionextUpgrade kernel-symsUpgrade dlm-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade kernel-sourceUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-rt-develUpgrade kernel-rt_debugUpgrade dtb-amazonUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-rtUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade kernel-debug-develUpgrade dtb-xilinxUpgrade dtb-qcomUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade dtb-amdUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade dtb-mediatekUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade kernel-debugUpgrade kselftests-kmp-azureUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade kernel-azure-extraUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade dtb-rockchipUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-lgUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade dtb-appleUpgrade kernel-docs-htmlUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade dtb-alteraUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-develUpgrade ocfs2-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade dtb-broadcomUpgrade kernel-default-base-rebuildUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-default-optionalUpgrade kernel-obs-buildUpgrade dlm-kmp-64kbUpgrade dtb-marvellUpgrade dtb-sprdUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub