CVE-2022-48897

What it actually does

On arm64, pmd_leaf() returns true for invalid PMDs due to pmd_present_invalid() logic, causing pmdp_invalidate() to incorrectly adjust file_map_count twice and set_pte_at() to increment it again, triggering BUG_ON() in page_table_check during __split_huge_pmd on madvise operations.

Why it matters to the business

Workloads using transparent hugepages on arm64 systems experience unexpected kernel crashes and downtime during memory management operations, affecting stability of servers and containers without requiring attacker intervention.

How an attack unfolds

An attacker or unprivileged process triggers the flaw by performing madvise operations that cause splitting of transparent hugepages on arm64, leading to the page table check accounting error and kernel BUG; no external threat actor or ransomware involvement is known.

How to fix it

Update the Linux kernel to the commit 21e5eca0ac9046da9918a919bc92b7b5a78d27e7 or later stable releases containing the !pmd_present_invalid() guard in pmd_user_accessible_page().

How to confirm the fix worked

Boot a patched kernel and run transhuge-stress or equivalent hugepage split workloads to confirm absence of the page_table_check BUG_ON; verify pmd_user_accessible_page contains the invalid PMD check via source inspection.

Typical attack path

1. Map memory using transparent hugepages on arm64
2. Invoke madvise with behavior that triggers unmap and huge PMD split
3. Hit pmd_user_accessible_page without invalid PMD guard during set_pte_at
4. Trigger BUG_ON in page_table_check_set

How to detect it

Search kernel logs for 'kernel BUG at mm/page_table_check.c:119' combined with call traces containing __split_huge_pmd and madvise; inspect ftrace or dmesg for transhuge-stres or similar processes triggering the oops on arm64.

What your security team should do

• Prioritize kernel upgrade on all arm64 systems using transparent hugepages within the next maintenance window
• Monitor for kernel oops involving page_table_check_set and __split_huge_pmd
• Temporarily disable THP on affected arm64 hosts if immediate patching is delayed