Critical Vulnerability in Linux Kernel: Memory Management Issue in Shmem Folio Replacement
Summary
DEBIAN-CVE-2024-40949: In the Linux kernel, the following vulnerability has been resolved: mm: shmem: fix getting incorrect lruvec when replacing a shmem folio When testing shmem swapin, I encountered the warning below on my machine. Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. This vulnerability affects versions of the Linux kernel in Debian 13 and 14, specifically related to the handling of shared memory (shmem) folios, which are crucial for efficient memory management in Linux systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the memory management subsystem, specifically within the handling of shared memory folios. When replacing an old shmem folio with a new one, the function mem_cgroup_migrate() inadvertently clears the memory control group (memcg) data of the old folio. This leads to the old folio being unable to retrieve the correct lruvec, which is necessary for its removal from the least recently used (LRU) list during the freeing process. The consequences of this flaw can be severe, potentially resulting in LRU list crashes due to incorrect locking and inaccurate LRU statistics, which can destabilize the system.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel related to memory management of shared memory folios poses significant risks to system stability. Users are urged to update to the patched version 6.9.7-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect handling of memory control group data when replacing shared memory folios, which can lead to system instability.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the patch version 6.9.7-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to crashes in the LRU list and incorrect memory management statistics, potentially destabilizing the system.
Currently, there are no specific workarounds available. It is recommended to apply the patch as soon as it is released.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
