In the Linux kernel, the following vulnerability has been resolved:
mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind()
syzbot reported access to unitialized memory in mbind() [1]
Issue came with commit bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes")
This commit added a new bit in MPOL_MODE_FLAGS, but only checked valid combination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in do_set_mempolicy()
This patch moves the check in sanitize_mpol_flags() so that it is also used by mbind()
[1] BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
Uninit was created at: slab_alloc_node mm/slub.c:3221 [inline] slab_alloc mm/slub.c:3230 [inline] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [inline] do_mbind+0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae ===================================================== Kernel panic - not syncing: panic_on_kmsan set ... CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G B 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 panic+0x44f/0xdeb kernel/panic.c:232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kernel-64kb-extraUpgrade dtb-freescaleUpgrade kernel-debugUpgrade kernel-devel-rtUpgrade gfs2-kmp-azureUpgrade kernel-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade dlm-kmp-rtUpgrade kernel-rt-develUpgrade cluster-md-kmp-rtUpgrade kernel-debug-develUpgrade dtb-armUpgrade kernel-64kb-livepatch-develUpgrade kernel-defaultUpgrade dtb-amazonUpgrade dtb-caviumUpgrade dtb-mediatekUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade kernel-rt_debugUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-azure-optionalUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-socionextUpgrade kernel-azure-extraUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-default-baseUpgrade cluster-md-kmp-64kbUpgrade dtb-hisiliconUpgrade kselftests-kmp-64kbUpgrade kernel-syms-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade dtb-rockchipUpgrade kernel-default-extraUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatch-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-develUpgrade dtb-marvellUpgrade dtb-apmUpgrade reiserfs-kmp-64kbUpgrade kernel-rtUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade dtb-nvidiaUpgrade kernel-rt-extraUpgrade kernel-sourceUpgrade kernel-rt-optionalUpgrade dlm-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-source-vanillaUpgrade kernel-obs-qaUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-develUpgrade kernel-obs-buildUpgrade dtb-exynosUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade dtb-lgUpgrade dtb-qcom | Aug 9, 2024 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub