CVE-2024-40914: mm/huge_memory: don't unpoison huge_zero_folio

Published Jul 12, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm/hugememory: don't unpoison hugezerofolio

When I did memory failure tests recently, below panic occurs:

kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 137 Comm: kswapd1 Not tainted 6.9.0-rc4-00491-gd5ce28f156fe-dirty #14 RIP: 0010:shrinkhugezeropagescan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 Call Trace: <TASK> doshrinkslab+0x14f/0x6a0 shrinkslab+0xca/0x8c0 shrinknode+0x2d0/0x7d0 balancepgdat+0x33a/0x720 kswapd+0x1f3/0x410 kthread+0xd5/0x100 retfromfork+0x2f/0x50 retfromforkasm+0x1a/0x30 </TASK> Modules linked in: mceinject hwpoisoninject ---[ end trace 0000000000000000 ]--- RIP: 0010:shrinkhugezeropagescan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0

The root cause is that HWPoison flag will be set for hugezerofolio without increasing the folio refcnt. But then unpoisonmemory() will decrease the folio refcnt unexpectedly as it appears like a successfully hwpoisoned folio leading to VMBUGONPAGE(pagerefcount(page) == 0) when releasing hugezerofolio.

Skip unpoisoning hugezerofolio in unpoisonmemory() to fix this issue. We're not prepared to unpoison hugezerofolio yet.

Affected Software

14 affected componentsFixes available
redhat/kernel<5.15.162
5.15.162
redhat/kernel<6.1.95
6.1.95
redhat/kernel<6.6.35
6.6.35
redhat/kernel<6.9.6
6.9.6
redhat/kernel<6.10
6.10
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-1
debian/linux-6.1
6.1.129-1~deb11u1
Linux Linux kernel>=5.15.41<5.15.162
Linux Linux kernel>=5.17.9<5.18
Linux Linux kernel>=5.18.1<6.1.95
Linux Linux kernel>=6.2<6.6.35
Linux Linux kernel>=6.7<6.9.6
Linux Linux kernel=5.18
Linux Linux kernel=5.18-rc7

Event History

Jul 12, 2024
CVE Published
via MITRE·12:24 PM
Data Sourced
via MITRE·12:24 PM
Description
Data Sourced
via NVD·01:15 PM
Description
Data Sourced
via NVD·01:15 PM
RemedySeverityAffected Software
May 1, 2025
Data Sourced
via Ubuntu·05:24 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-40914?

CVE-2024-40914 is classified as a medium-severity vulnerability in the Linux kernel.

2

How do I fix CVE-2024-40914?

To resolve CVE-2024-40914, update to the specified fixed versions of the kernel, such as 5.15.162, 6.1.95, 6.6.35, or other patched releases.

3

What versions of the kernel are affected by CVE-2024-40914?

CVE-2024-40914 affects various versions of the Linux kernel prior to 5.15.162, 6.1.95, and other specific patched versions.

4

What causes the kernel panic related to CVE-2024-40914?

The kernel panic associated with CVE-2024-40914 is triggered during memory failure tests due to a bug in the handling of huge zero folios.

5

Is CVE-2024-40914 a remote exploit vulnerability?

CVE-2024-40914 is not typically classified as a remote exploit vulnerability but poses risk during memory operations.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203