CVE-2023-4732

What it actually does

Race condition in pfn_swap_entry_to_page allows a local process to trigger a BUG() referencing an invalid pmd_t value, resulting in kernel panic and denial of service.

Why it matters to the business

Local users on affected Linux and Red Hat systems can force reboots or crashes, leading to unplanned downtime on servers and workstations; the vulnerability remains relevant across a wide installed base despite low exploit probability.

How an attack unfolds

An attacker with local shell access crafts a sequence of memory operations that wins the race in the swap entry handling path, hitting the BUG statement and crashing the kernel; no remote or unauthenticated vector exists and public exploits have not materialized.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the pfn_swap_entry_to_page race condition; apply vendor updates for all listed Red Hat products as soon as patches become available.

How to confirm the fix worked

Confirm the running kernel version is newer than the vulnerable release and that the pfn_swap_entry_to_page function no longer contains the unsafe BUG path; recompile or boot test kernels with the race-triggering workload to verify absence of panic.

Typical attack path

1. Obtain local user access on a vulnerable system
2. Execute a program that repeatedly exercises swap and page-table operations to trigger the race
3. Cause the BUG() in pfn_swap_entry_to_page leading to kernel panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for BUG statements containing pfn_swap_entry_to_page or pmd_t references; correlate with process creation events immediately preceding the panic.

• BUG: unable to handle kernel paging request in pfn_swap_entry_to_page
• pmd_t x referenced in swap entry path

What your security team should do

• Inventory all systems running the affected Linux kernel versions and schedule patching during the next maintenance window
• Restrict local user accounts and monitor for unusual memory or swap activity until patches are deployed
• Review kernel logs for any BUG messages referencing pmd_t or pfn_swap_entry_to_page as part of routine hardening