CVE-2024-57883: mm: hugetlb: independent PMD page table shared count

Published Jan 15, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: independent PMD page table shared count

The folio refcount may be increased unexpectly through trygetfolio() by caller such as splithugepages. In hugepmdunshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked:

BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) pagetype: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BADPAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: showstack+0x20/0x38 (C) dumpstacklvl+0x80/0xf8 dumpstack+0x18/0x28 badpage+0x8c/0x130 freepageisbadreport+0xa4/0xb0 freeunrefpage+0x3cc/0x620 folioput+0xf4/0x158 splithugepagesall+0x1e0/0x3e8 splithugepageswrite+0x25c/0x2d8 fullproxywrite+0x64/0xd8 vfswrite+0xcc/0x280 ksyswrite+0x70/0x110 arm64syswrite+0x24/0x38 invokesyscall+0x50/0x120 el0svccommon.constprop.0+0xc8/0xf0 doel0svc+0x24/0x38 el0svc+0x34/0x128 el0t64synchandler+0xc8/0xd0 el0t64sync+0x190/0x198

The issue may be triggered by damon, offlinepage, pageidle, etc, which will increase the refcount of page table.

1. The page table itself will be discarded after reporting the "nonzero mapcount".

2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped.

Fix it by introducing independent PMD page table shared count. As described by comment, ptindex/ptmm/ptfragrefcount are used for s390 gmap, x86 pgds and powerpc, ptsharecount is used for x86/arm64/riscv pmds, so we can reuse the field as ptsharecount.

Other sources

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

Launchpad

Affected Software

12 affected componentsFixes available
Linux Kernel>=6.13.0-rc2
debian/linux<=5.10.223-1, <=5.10.234-1, <=6.1.129-1, <=6.1.135-1
6.12.27-1
Linux Linux kernel>=2.6.20<5.10.239
Linux Linux kernel>=5.11<5.15.186
Linux Linux kernel>=5.16<6.1.142
Linux Linux kernel>=6.2<6.6.72
Linux Linux kernel>=6.7<6.12.9
Linux Linux kernel=6.13-rc1
Linux Linux kernel=6.13-rc2
Linux Linux kernel=6.13-rc3
Linux Linux kernel=6.13-rc4
Linux Linux kernel=6.13-rc5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.12.27-1

Event History

Jan 15, 2025
CVE Published
via MITRE·01:05 PM
Data Sourced
via MITRE·01:05 PM
DescriptionSeverity
Data Sourced
via NVD·01:15 PM
Description
Data Sourced
via NVD·01:15 PM
RemedySeverityAffected Software
Mar 31, 2025
Data Sourced
via Launchpad·06:50 PM
Description
May 2, 2025
Data Sourced
via Ubuntu·06:55 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-57883?

CVE-2024-57883 has been classified with a severity that necessitates prompt attention due to potential impacts on stability and security.

2

How do I fix CVE-2024-57883?

To fix CVE-2024-57883, you should update to a patched version of the Linux kernel that addresses this specific vulnerability.

3

Which Linux kernel versions are affected by CVE-2024-57883?

CVE-2024-57883 affects versions of the Linux kernel starting from 6.13.0-rc2 and onwards.

4

What components are impacted by CVE-2024-57883?

CVE-2024-57883 impacts the hugetlb memory management subsystem within the Linux kernel.

5

Is there a known exploit for CVE-2024-57883?

As of now, there are no confirmed public exploits targeting CVE-2024-57883, but the vulnerability still poses a risk.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203