CVE-2024-26621: mm: huge_memory: don't force huge page alignment on 32 bit
In the Linux kernel, the following vulnerability has been resolved:
mm: hugememory: don't force huge page alignment on 32 bit
commit efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") caused two issues [1] [2] reported on 32 bit system or compat userspace.
It doesn't make too much sense to force huge page alignment on 32 bit system due to the constrained virtual address space.
[1] https://lore.kernel.org/linux-mm/d0a136a0-4a31-46bc-adf4-2db109a61672@kernel.org/ [2] https://lore.kernel.org/linux-mm/CAJuCfpHXLdQy1a2B6xN2d7quTYwg2OoZseYPZTRpU0eHHKD-sQ@mail.gmail.com/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch efa7df3e3bb5 - Compensating control
Apply the kernel change for the issue described for 32-bit/compat systems: do not force huge page alignment for larger anonymous mappings on 32-bit due to constrained virtual address space.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26621?
CVE-2024-26621 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-26621?
To fix CVE-2024-26621, update your Linux kernel to a version higher than 6.1.81 or install the recommended patches.
Which versions of the Linux kernel are affected by CVE-2024-26621?
CVE-2024-26621 affects Linux kernel versions between 5.18 and 6.1.81, and some versions between 6.2 and 6.8-rc2.
What types of systems are impacted by CVE-2024-26621?
CVE-2024-26621 primarily impacts 32-bit systems and users running compatible userspace.
Is CVE-2024-26621 specific to any particular Linux distribution?
CVE-2024-26621 is specific to the Linux kernel, affecting all distributions that utilize the affected versions of the kernel.