mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation. hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM. On failure nothing needs to be unwound: • the node is never marked online • per_cpu_nodestats is left pointing at boot_nodestats • __add_memory_resource() cleans up pending memblock resources • later online attempts retry the per_cpu_nodestats allocation
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 75ef7184053989118d3814c558a9af62e7376a58 · fixed in 4dda09e7ca0bf0c3fa7c5c8f134d9804b67f455c; From 75ef7184053989118d3814c558a9af62e7376a58 · fixed in 4cc5caef9a8d1894dfa31d84a0daa0ac1437dadc; From 75ef7184053989118d3814c558a9af62e7376a58 · fixed in bc3b5e6519b8df22d622a03eab6772784da97db4; From 75ef7184053989118d3814c558a9af62e7376a58 · fixed in 1017fe1c7f48e511c5a680e3057005daaff2f3a2; From 75ef7184053989118d3814c558a9af62e7376a58 · fixed in 2ebce860bdd7ae5e13002811bc9bbbf33fcfc221
- Linux Linux
4.8
- KernelLinux
From 4.8.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6