CVE-2024-40949: mm: shmem: fix getting incorrect lruvec when replacing a shmem folio

Published Jul 12, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm: shmem: fix getting incorrect lruvec when replacing a shmem folio

When testing shmem swapin, I encountered the warning below on my machine. The reason is that replacing an old shmem folio with a new one causes memcgroupmigrate() to clear the old folio's memcg data. As a result, the old folio cannot get the correct memcg's lruvec needed to remove itself from the LRU list when it is being freed. This could lead to possible serious problems, such as LRU list crashes due to holding the wrong LRU lock, and incorrect LRU statistics.

To fix this issue, we can fallback to use the memcgroupreplacefolio() to replace the old shmem folio.

[ 5241.100311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5d9960 [ 5241.100317] head: order:4 mapcount:0 entiremapcount:0 nrpagesmapped:0 pincount:0 [ 5241.100319] flags: 0x17fffe0000040068(uptodate|lru|head|swapbacked|node=0|zone=2|lastcpupid=0x3ffff) [ 5241.100323] raw: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000 [ 5241.100325] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100326] head: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000 [ 5241.100327] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100328] head: 17fffe0000000204 fffffdffd6665801 ffffffffffffffff 0000000000000000 [ 5241.100329] head: 0000000a00000010 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100330] page dumped because: VMWARNONONCEFOLIO(!memcg && !memcgroupdisabled()) [ 5241.100338] ------------[ cut here ]------------ [ 5241.100339] WARNING: CPU: 19 PID: 78402 at include/linux/memcontrol.h:775 foliolruveclockirqsave+0x140/0x150 [...] [ 5241.100374] pc : foliolruveclockirqsave+0x140/0x150 [ 5241.100375] lr : foliolruveclockirqsave+0x138/0x150 [ 5241.100376] sp : ffff80008b38b930 [...] [ 5241.100398] Call trace: [ 5241.100399] foliolruveclockirqsave+0x140/0x150 [ 5241.100401] pagecacherelease+0x90/0x300 [ 5241.100404] folioput+0x50/0x108 [ 5241.100406] shmemreplacefolio+0x1b4/0x240 [ 5241.100409] shmemswapinfolio+0x314/0x528 [ 5241.100411] shmemgetfoliogfp+0x3b4/0x930 [ 5241.100412] shmemfault+0x74/0x160 [ 5241.100414] dofault+0x40/0x218 [ 5241.100417] dosharedfault+0x34/0x1b0 [ 5241.100419] dofault+0x40/0x168 [ 5241.100420] handleptefault+0x80/0x228 [ 5241.100422] handlemmfault+0x1c4/0x440 [ 5241.100424] handlemmfault+0x60/0x1f0 [ 5241.100426] dopagefault+0x120/0x488 [ 5241.100429] dotranslationfault+0x4c/0x68 [ 5241.100431] domemabort+0x48/0xa0 [ 5241.100434] el0da+0x38/0xc0 [ 5241.100436] el0t64synchandler+0x68/0xc0 [ 5241.100437] el0t64sync+0x14c/0x150 [ 5241.100439] ---[ end trace 0000000000000000 ]---

[baolin.wang@linux.alibaba.com: remove less helpful comments, per Matthew]

Affected Software

6 affected componentsFixes available
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-1
Linux Linux kernel>=6.7<6.9.7
Linux Linux kernel=6.10-rc1
Linux Linux kernel=6.10-rc2
Linux Linux kernel=6.10-rc3
Linux Linux kernel=6.10-rc4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1

Event History

Jul 12, 2024
CVE Published
via MITRE·12:31 PM
Data Sourced
via MITRE·12:31 PM
DescriptionSeverity
Data Sourced
via NVD·01:15 PM
Description
Data Sourced
via NVD·01:15 PM
RemedySeverityAffected Software
Apr 27, 2025
Data Sourced
via Ubuntu·05:24 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-40949?

CVE-2024-40949 is classified as a low severity vulnerability affecting the Linux kernel.

2

How do I fix CVE-2024-40949?

You can fix CVE-2024-40949 by updating your Linux kernel to at least version 5.10.223-1 or to one of the specified patched versions.

3

What systems are affected by CVE-2024-40949?

CVE-2024-40949 affects various versions of the Linux kernel, particularly those listed under the affected software section.

4

What exploitation potential does CVE-2024-40949 have?

CVE-2024-40949 does not present significant exploitation potential but may lead to incorrect memory management under certain conditions.

5

Is CVE-2024-40949 specific to a particular Linux distribution?

CVE-2024-40949 has been reported in Debian's Linux kernel packages but may also affect other distributions using similar kernel versions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203