In the Linux kernel, the following vulnerability has been resolved:
fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super() caused by assigning NULL to ctx->hstate in hugetlbfs_parse_param() when the requested pagesize is non valid.
E.g: Taking the following steps:
fd = fsopen("hugetlbfs", FSOPEN_CLOEXEC); fsconfig(fd, FSCONFIG_SET_STRING, "pagesize", "1024", 0); fsconfig(fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);
Given that the requested "pagesize" is invalid, ctxt->hstate will be replaced with NULL, losing its previous value, and we will print an error:
... ... case Opt_pagesize: ps = memparse(param->string, &rest); ctx->hstate = h; if (!ctx->hstate) { pr_err("Unsupported page size %lu MB\n", ps / SZ_1M); return -EINVAL; } return 0; ... ...
This is a problem because later on, we will dereference ctxt->hstate in hugetlbfs_fill_super()
... ... sb->s_blocksize = huge_page_size(ctx->hstate); ... ...
Causing below Oops.
Fix this by replacing cxt->hstate value only when then pagesize is known to be valid.
kernel: hugetlbfs: Unsupported page size 0 MB kernel: BUG: kernel NULL pointer dereference, address: 0000000000000028 kernel: #PF: supervisor read access in kernel mode kernel: #PF: error_code(0x0000) - not-present page kernel: PGD 800000010f66c067 P4D 800000010f66c067 PUD 1b22f8067 PMD 0 kernel: Oops: 0000 [#1] PREEMPT SMP PTI kernel: CPU: 4 PID: 5659 Comm: syscall Tainted: G E 6.8.0-rc2-default+ #22 5a47c3fef76212addcc6eb71344aabc35190ae8f kernel: Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017 kernel: RIP: 0010:hugetlbfs_fill_super+0xb4/0x1a0 kernel: Code: 48 8b 3b e8 3e c6 ed ff 48 85 c0 48 89 45 20 0f 84 d6 00 00 00 48 b8 ff ff ff ff ff ff ff 7f 4c 89 e7 49 89 44 24 20 48 8b 03 <8b> 48 28 b8 00 10 00 00 48 d3 e0 49 89 44 24 18 48 8b 03 8b 40 28 kernel: RSP: 0018:ffffbe9960fcbd48 EFLAGS: 00010246 kernel: RAX: 0000000000000000 RBX: ffff9af5272ae780 RCX: 0000000000372004 kernel: RDX: ffffffffffffffff RSI: ffffffffffffffff RDI: ffff9af555e9b000 kernel: RBP: ffff9af52ee66b00 R08: 0000000000000040 R09: 0000000000370004 kernel: R10: ffffbe9960fcbd48 R11: 0000000000000040 R12: ffff9af555e9b000 kernel: R13: ffffffffa66b86c0 R14: ffff9af507d2f400 R15: ffff9af507d2f400 kernel: FS: 00007ffbc0ba4740(0000) GS:ffff9b0bd7000000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 0000000000000028 CR3: 00000001b1ee0000 CR4: 00000000001506f0 kernel: Call Trace: kernel: <TASK> kernel: ? __die_body+0x1a/0x60 kernel: ? page_fault_oops+0x16f/0x4a0 kernel: ? search_bpf_extables+0x65/0x70 kernel: ? fixup_exception+0x22/0x310 kernel: ? exc_page_fault+0x69/0x150 kernel: ? asm_exc_page_fault+0x22/0x30 kernel: ? __pfx_hugetlbfs_fill_super+0x10/0x10 kernel: ? hugetlbfs_fill_super+0xb4/0x1a0 kernel: ? hugetlbfs_fill_super+0x28/0x1a0 kernel: ? __pfx_hugetlbfs_fill_super+0x10/0x10 kernel: vfs_get_super+0x40/0xa0 kernel: ? __pfx_bpf_lsm_capable+0x10/0x10 kernel: vfs_get_tree+0x25/0xd0 kernel: vfs_cmd_create+0x64/0xe0 kernel: __x64_sys_fsconfig+0x395/0x410 kernel: do_syscall_64+0x80/0x160 kernel: ? syscall_exit_to_user_mode+0x82/0x240 kernel: ? do_syscall_64+0x8d/0x160 kernel: ? syscall_exit_to_user_mode+0x82/0x240 kernel: ? do_syscall_64+0x8d/0x160 kernel: ? exc_page_fault+0x69/0x150 kernel: entry_SYSCALL_64_after_hwframe+0x6e/0x76 kernel: RIP: 0033:0x7ffbc0cb87c9 kernel: Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 97 96 0d 00 f7 d8 64 89 01 48 kernel: RSP: 002b:00007ffc29d2f388 EFLAGS: 00000206 ORIG_RAX: 00000000000001af kernel: RAX: fffffffffff ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-livepatch-5.15.152-100.162Upgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.213-201.855Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-toolsUpgrade kernel-develUpgrade bpftoolUpgrade kernel-tools-devel | Aug 28, 2024 | Apr 3, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade python3-perfUpgrade kernel-livepatch-6.1.79-99.164Upgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade perfUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-devel | Feb 17, 2025 | Apr 3, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 3, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel | Jun 26, 2024 | Apr 3, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftool | Oct 8, 2024 | Apr 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 3, 2024 |
| Suse | — | Upgrade dtb-armUpgrade kernel-docsUpgrade kernel-64kbUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-azure-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-qcomUpgrade dtb-socionextUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-sourceUpgrade dtb-mediatekUpgrade kernel-rt_debug-vdsoUpgrade dtb-marvellUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-develUpgrade kernel-kvmsmall-develUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-source-azureUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade kernel-rt-vdsoUpgrade dtb-freescaleUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-lgUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade dtb-amazonUpgrade kselftests-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-preempt-develUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-develUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade kernel-source-vanillaUpgrade kernel-azureUpgrade dtb-rockchipUpgrade kernel-rt-livepatchUpgrade kernel-default-develUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dtb-amdUpgrade dtb-alteraUpgrade kernel-debug-develUpgrade kernel-default-baseUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade kernel-source-rtUpgrade kernel-preemptUpgrade reiserfs-kmp-64kbUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-hisiliconUpgrade kernel-debug-vdsoUpgrade dtb-sprdUpgrade dtb-appleUpgrade dtb-renesasUpgrade kselftests-kmp-azureUpgrade dtb-xilinxUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade dtb-allwinnerUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-devel-rtUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade kernel-default-optional | May 15, 2024 | Apr 3, 2024 |
| Ubuntu | — | Upgrade linux-image-intelUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-raspiUpgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-5.4.0-1130-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-186-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-starfiveUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-generic-lpaeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-oem-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-5.4.0-1038-iotUpgrade linux-image-5.4.0-1131-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-5.4.0-1073-ibmUpgrade linux-image-gcpUpgrade linux-image-oem-22.04aUpgrade linux-image-oem-20.04cUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-6.5Upgrade linux-image-5.4.0-1045-xilinx-zynqmpUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.4.0-1093-gkeopUpgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-raspi2Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-5.4.0-1126-awsUpgrade linux-image-5.4.0-1086-bluefieldUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-186-genericUpgrade linux-image-nvidiaUpgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-azure-lts-20.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-azureUpgrade linux-image-5.4.0-186-generic-lpaeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1063-awsUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-113-genericUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04bUpgrade linux-image-genericUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-gkeUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oemUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.5.0-1023-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-6.5.0-1024-azureUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-5.4.0-1110-raspiUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1125-oracleUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-oem-osp1Upgrade linux-image-virtualUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-5.4.0-1114-kvmUpgrade linux-image-intel-iotgUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-kvm | Jul 1, 2024 | Apr 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub