Critical Vulnerability in Linux Kernel: PMD-sized Page Cache Allocation Issue
Summary
DEBIAN-CVE-2024-41031: In the Linux kernel, the following vulnerability has been resolved: mm/filemap: skip to create PMD-sized page cache if needed On ARM64, HPAGE_PMD_ORDER is 13 when the base page size is 64KB. Affects linux versions < 6.9.10-1. Fixed in 6.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the Linux kernel versions in Debian 13 and 14, which utilize PMD-sized page cache allocation on ARM64 architecture. The issue arises when the kernel attempts to create a PMD-sized page cache that cannot be supported by the xarray, leading to potential system instability and performance degradation.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2024-41031, originates from an oversight in the memory management subsystem of the Linux kernel. When the kernel tries to allocate a PMD-sized page cache, it encounters errors due to the limitations of the xarray. This can lead to warnings and potential crashes, especially under high-load scenarios. The specific error messages indicate that the CPU and process identifiers are logged, which can aid in debugging but also highlight the severity of the issue. If left unaddressed, this vulnerability could result in system crashes or degraded performance, affecting applications relying on the kernel's memory management.
How To Fix
Minimum fixed version
6.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid allocating PMD-sized page caches by configuring their system to fall back to regular page cache allocation. This can be done by adjusting the read-ahead settings in the BDI's sysfs file (read_ahead_kb). However, this is not a permanent solution and should be followed by applying the patch as soon as possible.
Conclusion
In summary, DEBIAN-CVE-2024-41031 is a critical vulnerability in the Linux kernel affecting Debian 13 and 14. It is essential for users to update their kernel to the patched version to ensure system stability and performance. While a temporary workaround exists, applying the patch is the recommended course of action.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2024-41031 is a vulnerability in the Linux kernel that affects the allocation of PMD-sized page caches, potentially leading to system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability can lead to system crashes, degraded performance, and instability in applications relying on the Linux kernel.
To apply the patch, update your Linux kernel package to version 6.9.10-1 using the command: 'sudo apt-get update && sudo apt-get install linux'.
Yes, a temporary workaround involves adjusting the read-ahead settings in the BDI's sysfs file to avoid PMD-sized page cache allocation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
