CVE-2023-52739

What it actually does

Race condition in __free_pages allows a compound page to be partially freed after its reference count drops, causing tail pages to be freed multiple times and resulting in bad page state, free list corruption, or kernel crashes during subsequent allocations.

Why it matters to the business

Systems running affected kernels may experience unexpected crashes, memory corruption, or service outages during normal operation or under memory pressure, leading to downtime and potential data loss in production workloads.

How an attack unfolds

An attacker with the ability to trigger page allocation and freeing patterns (such as through network or filesystem activity) can race the reference count check and PageHead test in the page allocator, causing the kernel to double-free tail pages of a compound allocation and corrupt memory structures.

How to fix it

Update the Linux kernel to a version containing commit 0a626e27f984dfbe96bd8e4fd08f20a2ede3ea23 or later; rebuild and reboot all affected systems with the patched kernel.

How to confirm the fix worked

Confirm the running kernel includes commit 0a626e27f984dfbe96bd8e4fd08f20a2ede3ea23 via 'git log' or package version checks; monitor for absence of 'BUG: Bad page state' and 'nonzero mapcount' messages after upgrade.

Typical attack path

1. Trigger allocation of compound pages via user-space or kernel activity
2. Force concurrent freeing paths that drop the final reference
3. Exploit the window where PageHead returns false on a now-freed page
4. Cause double-free of tail pages leading to allocator corruption
5. Trigger subsequent allocations to surface bad page state or crashes

How to detect it

Search kernel logs for 'BUG: Bad page state', 'nonzero mapcount', and 'page dumped because' messages; inspect crash dumps for rmqueue or get_page_from_freelist call traces originating from __free_pages paths.

What your security team should do

• Prioritize kernel updates on all production systems within the next maintenance window
• Enable kernel panic on oops to limit exposure from corrupted state
• Review workloads that perform heavy page allocation/freeing for stability after patching