PT-2025-3606 · Linux+3 · Linux Kernel+3

Vlastimil Babka · Published 2024-12-18 · Updated 2025-09-29 · CVE-2024-57881

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises in the split large buddy() function where pfn to page() might be called on a possibly non-existent PFN. In specific corner cases, such as freeing the highest pageblock in the last memory section with CONFIG SPARSEMEM and !CONFIG SPARSEMEM EXTREME, this could lead to pfn to section() returning NULL and section mem map addr() dereferencing that NULL pointer. The problem was identified through code inspection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

ALT-PU-2025-1925

ALT-PU-2025-3483

BDU:2025-15368

CVE-2024-57881

USN-7379-1

USN-7379-2

USN-7380-1

USN-7381-1

USN-7382-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Ubuntu

References · 342

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57881.json · Exploit
• https://ubuntu.com/security/CVE-2024-56639 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56593 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56602 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56594 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36476 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56580 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56588 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-57791 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-57799 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52319 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-56667 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-57895 · Vendor Advisory