PT-2024-32203 · Linux+1 · Linux Kernel+1

Published 2024-08-26 · Updated 2026-05-09 · CVE-2024-46790

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.9

Description The issue arises when PG hwpoison pages are freed and treated differently in free pages prepare(), leading to isolation instead of release. Page allocation tag counters are decremented, considering the page not in use. Later, when such pages are released by unpoison memory(), the allocation tag counters are decremented again, resulting in a warning. The vulnerability can be fixed by clearing the page tag reference after the page is isolated and accounted for.

Recommendations To resolve the issue, clear the page tag reference after the page got isolated and accounted for. This can be achieved by modifying the kernel code to properly handle PG hwpoison pages during the free pages prepare() process. As a temporary workaround, consider disabling the hwpoison inject module until a patch is available.

Exploit

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

BDU:2025-05925

CVE-2024-46790

Affected Products

Astra Linux

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46790.json · Exploit
• https://git.kernel.org/stable/c/16ad36c8e66a26626e7d0224100b433483a2acef · Patch
• https://git.kernel.org/stable/c/5e9784e997620af7c1399029282f5d6964b41942 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2024-46790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46790 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-46790 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46790 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46790 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-46790 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-46790 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-46790 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05925 · Security Note
• https://lore.kernel.org/linux-cve-announce/2024091853-CVE-2024-46790-33ec@gregkh · Note
• https://twitter.com/oktsec/status/1836353888007446827 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note