PT-2024-10407 · Linux+6 · Linux Kernel+6
Miaohe Lin
·
Published
2024-05-23
·
Updated
2026-05-26
·
CVE-2024-39298
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The vulnerability is related to the handling of dissolved but not taken off from buddy pages in the Linux kernel's memory failure module. This can cause a kernel panic due to a bad page state. The root cause of the issue is a race condition between the
memory failure and try memory failure hugetlb functions, specifically in the me huge page function. The vulnerability can be exploited by an attacker to cause a denial of service.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.37 or later. If updating is not possible, consider disabling the
me huge page function or restricting access to the vulnerable module as a temporary workaround. However, these workarounds may have performance implications and should be thoroughly tested before implementation.Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu