PT-2024-26830 · Linux+4 · Linux Kernel+4

Luis Chamberlain · Published 2024-03-21 · Updated 2024-11-15 · CVE-2024-35993

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the folio test hugetlb() function, which can be fooled by a concurrent folio split into returning true for a folio that has never belonged to hugetlbfs. This can happen in places like memory-failure, compaction, and procfs, where a speculative reference is not taken. The PageType field is available since hugetlb pages do not use individual page mapcounts and page mapcount() ignores the value in this field. With CONFIG DEBUG VM enabled, the current implementation can result in an oops, as reported by Luis, due to VM BUG ON() checks added in the PageHuge() testing path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2025-08079

CVE-2024-35993

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 262

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35993.json · Exploit
• https://ubuntu.com/security/CVE-2024-35984 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6952-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35993 · Security Note
• https://ubuntu.com/security/CVE-2024-36891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36893 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27398 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38603 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6952-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08079 · Security Note