CVE-2024-40914
mm/huge_memory: don't unpoison huge_zero_folio
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 137 Comm: kswapd1 Not tainted 6.9.0-rc4-00491-gd5ce28f156fe-dirty #14 RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 Call Trace: <TASK> do_shrink_slab+0x14f/0x6a0 shrink_slab+0xca/0x8c0 shrink_node+0x2d0/0x7d0 balance_pgdat+0x33a/0x720 kswapd+0x1f3/0x410 kthread+0xd5/0x100 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: mce_inject hwpoison_inject ---[ end trace 0000000000000000 ]--- RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 The root cause is that HWPoison flag will be set for huge_zero_folio without increasing the folio refcnt. But then unpoison_memory() will decrease the folio refcnt unexpectedly as it appears like a successfully hwpoisoned folio leading to VM_BUG_ON_PAGE(page_ref_count(page) == 0) when releasing huge_zero_folio. Skip unpoisoning huge_zero_folio in unpoison_memory() to fix this issue. We're not prepared to unpoison huge_zero_folio yet.
References
- https://git.kernel.org/stable/c/688bb46ad339497b5b7f527b6636d2afe04b46af
- https://git.kernel.org/stable/c/b2494506f30675245a3e6787281f79601af087bf
- https://git.kernel.org/stable/c/0d73477af964dbd7396163a13817baf13940bca9
- https://git.kernel.org/stable/c/d72b7711919de49d92a67dfc844a6cf4c23dd794
- https://git.kernel.org/stable/c/fe6f86f4b40855a130a19aa589f9ba7f650423f4
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-38725
- GCVE · GCVE-0-2024-40914
CERT-FR advisories
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0823 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0778 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0749 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0728 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0613 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.41 < 5.15.162cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17.9 < 5.18cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.18.1 < 6.1.95cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.35cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.9.6cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected f8f836100fff594cea8a0a027affb9d5520f09a7 < 688bb46ad339497b5b7f527b6636d2afe04b46af ; affected 478d134e9506c7e9bfe2830ed03dd85e97966313 < b2494506f30675245a3e6787281f79601af087bf ; affected 478d134e9506c7e9bfe2830ed03dd85e97966313 < 0d73477af964dbd7396163a13817baf13940bca9 ; affected 478d134e9506c7e9bfe2830ed03dd85e97966313 < d72b7711919de49d92a67dfc844a6cf4c23dd794 ; affected 478d134e9506c7e9bfe2830ed03dd85e97966313 < fe6f86f4b40855a130a19aa589f9ba7f650423f4 ; affected 13d9b8cd12f37d133b07ea5b323583e8a0c6b738 |
| Linux · Linux | affected 5.18 ; unaffected 0 < 5.18 ; unaffected 5.15.162 ≤ 5.15.* ; unaffected 6.1.95 ≤ 6.1.* ; unaffected 6.6.35 ≤ 6.6.* ; unaffected 6.9.6 ≤ 6.9.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |