In the Linux kernel, the following vulnerability has been resolved:
device-dax: correct pgoff align in dax_set_mapping()
pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the next alignment, that can result in memory failure getting the wrong address.
It's a subtle situation that only can be observed in page_mapped_in_vma() after the page is page fault handled by dev_dax_huge_fault. Generally, there is little chance to perform page_mapped_in_vma in dev-dax's page unless in specific error injection to the dax device to trigger an MCE - memory-failure. In that case, page_mapped_in_vma() will be triggered to determine which task is accessing the failure address and kill that task in the end.
We used self-developed dax device (which is 2M aligned mapping) , to perform error injection to random address. It turned out that error injected to non-2M-aligned address was causing endless MCE until panic. Because page_mapped_in_vma() kept resulting wrong address and the task accessing the failure address was never killed properly:
[ 3783.719419] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.049006] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.049190] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.448042] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.448186] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.792026] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.792179] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.162502] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.162633] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.461116] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.461247] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.764730] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.764859] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.042128] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.042259] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.464293] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.464423] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.818090] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.818217] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3787.085297] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3787.085424] Memory failure: 0x200c9742: recovery action for dax page: Recovered
It took us several weeks to pinpoint this problem, but we eventually used bpftrace to trace the page fault and mce address and successfully identified the issue.
Joao added:
; Likely we never reproduce in production because we always pin : device-dax regions in the region align they provide (Qemu does : similarly with prealloc in hugetlb/file backed memory). I think this : bug requires that we touch *unpinned* device-dax regions unaligned to : the device-dax selected alignment (page size i.e. 4K/2M/1G)
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Nov 11, 2024 | Oct 21, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 13, 2025 | Oct 21, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | May 15, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.11.0-1009-azureUpgrade linux-image-awsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-56-genericUpgrade linux-image-virtualUpgrade linux-image-oem-22.04aUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1024-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-56-lowlatency-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-6.8.0-56-generic-64kUpgrade linux-image-6.8.0-1024-nvidiaUpgrade linux-image-6.8.0-1026-gcp-64kUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-oem-22.04cUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-azure-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1024-nvidia-lowlatencyUpgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1022-oracle-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-6.8.1-1018-realtimeUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1008-gkeopUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1025-awsUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1026-gcpUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-6.8.0-56-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-57-genericUpgrade linux-image-oracleUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-raspiUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-gkeopUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1025-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1021-gkeUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1024-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1022-oracle | Feb 20, 2025 | Oct 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub