In the Linux kernel, the following vulnerability has been resolved:
Fix page corruption caused by racy check in __free_pages
When we upgraded our kernel, we started seeing some page corruption like the following consistently:
BUG: Bad page state in process ganesha.nfsd pfn:1304ca page:0000000022261c55 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1304ca flags: 0x17ffffc0000000() raw: 0017ffffc0000000 ffff8a513ffd4c98 ffffeee24b35ec08 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount CPU: 0 PID: 15567 Comm: ganesha.nfsd Kdump: loaded Tainted: P B O 5.10.158-1.nutanix.20221209.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 Call Trace: dump_stack+0x74/0x96 bad_page.cold+0x63/0x94 check_new_page_bad+0x6d/0x80 rmqueue+0x46e/0x970 get_page_from_freelist+0xcb/0x3f0 ? _cond_resched+0x19/0x40 __alloc_pages_nodemask+0x164/0x300 alloc_pages_current+0x87/0xf0 skb_page_frag_refill+0x84/0x110 ...
Sometimes, it would also show up as corruption in the free list pointer and cause crashes.
After bisecting the issue, we found the issue started from commit e320d3012d25 ("mm/page_alloc.c: fix freeing non-compound pages"):
if (put_page_testzero(page)) free_the_page(page, order); else if (!PageHead(page)) while (order-- > 0) free_the_page(page + (1 << order), order);
So the problem is the check PageHead is racy because at this point we already dropped our reference to the page. So even if we came in with compound page, the page can already be freed and PageHead can return false and we will end up freeing all the tail pages causing double free.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade python-perfUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.102-61.139Upgrade perf-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.10.173-154.642Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64 | Dec 12, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade bpftoolUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.12-17.42Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade perfUpgrade kernel-headersUpgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Feb 11, 2025 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade dtb-alteraUpgrade kernel-default-base-rebuildUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade dtb-lgUpgrade dlm-kmp-rtUpgrade dtb-appleUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-rt-extraUpgrade dtb-marvellUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade kernel-source-azureUpgrade kernel-debug-vdsoUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatchUpgrade kernel-default-develUpgrade kernel-azureUpgrade dtb-allwinnerUpgrade dtb-freescaleUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-exynosUpgrade kernel-source-rtUpgrade kernel-source-vanillaUpgrade dtb-broadcomUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-sourceUpgrade kernel-rt-optionalUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade dtb-caviumUpgrade kselftests-kmp-azureUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade kernel-default-baseUpgrade dlm-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-rtUpgrade dtb-hisiliconUpgrade kselftests-kmp-rtUpgrade kernel-rtUpgrade kernel-devel-azureUpgrade kernel-obs-qaUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-syms-rtUpgrade dtb-xilinxUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade dtb-socionextUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-default-extraUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-debug-develUpgrade dtb-qcomUpgrade dtb-armUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade dtb-amlogicUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-azure-vdsoUpgrade dtb-amdUpgrade kernel-azure-livepatch-develUpgrade kernel-docsUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade kernel-macros | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-intel-iotg-5.15Upgrade linux-gkeop-5.15Upgrade linux-aws-5.15Upgrade linux-oracleUpgrade linux-gcpUpgrade linux-riscv-5.15Upgrade linux-raspiUpgrade linux-realtimeUpgrade linux-ibmUpgrade linux-intel-iotgUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-azure-5.15Upgrade linux-azure-fdeUpgrade linux-azureUpgrade linux-oracle-5.15Upgrade linux-nvidiaUpgrade linux-bluefieldUpgrade linux-hwe-5.15Upgrade linux-kvmUpgrade linux-intel-iot-realtimeUpgrade linux-gkeUpgrade linux-gkeopUpgrade linux-awsUpgrade linux-lowlatencyUpgrade linuxUpgrade linux-azure-fde-5.15 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub