Critical Vulnerability in Linux Kernel: Folio Test Hugetlb Issue
Summary
DEBIAN-CVE-2024-35993: In the Linux kernel, the following vulnerability has been resolved: mm: turn folio_test_hugetlb into a PageType The current folio_test_hugetlb() can be fooled by a concurrent folio split into returning true for a folio w... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system integrity and performance. This specific vulnerability affects the Linux kernel versions in Debian 13 and 14, highlighting a flaw in the folio_test_hugetlb function, which can lead to erroneous behavior under certain conditions.
Vulnerability Detail
In the Linux kernel, the folio_test_hugetlb function can be misled by a concurrent folio split, causing it to incorrectly identify a folio that has never belonged to hugetlbfs as valid. This issue arises when the caller does not hold a reference count on the folio, which is the case in several scenarios like memory-failure and compaction. The vulnerability can lead to system crashes (oops) when CONFIG_DEBUG_VM is enabled, particularly after changes made in commit 9c5ccf2db04b. The implications of this vulnerability can include system instability and potential data loss.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate potential risks.
Conclusion
The folio_test_hugetlb vulnerability in the Linux kernel presents a significant risk to systems running affected versions. It is essential to apply the available patch promptly to ensure system stability and security. Regular monitoring and updates are crucial for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
It is a flaw in the Linux kernel that can lead to incorrect identification of hugetlbfs folios, potentially causing system crashes.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the patch version 6.8.9-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan for an update as soon as possible.
Failing to address this vulnerability can lead to system instability, crashes, and potential data loss, especially in environments where hugetlbfs is used.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
