CVE-2024-27007

What it actually does

The flaw leaves the src_folio mapping and index update in the wrong order for huge-page UFFDIO_MOVE operations, allowing a pinned folio to have its metadata changed before the page-table entry is cleared and the pin is released, which breaks swapout and migration and can produce memory corruption.

Why it matters to the business

Unpatched kernels may experience system instability, application crashes, or silent data corruption on workloads that use userfaultfd with transparent huge pages, raising operational risk and potential data-integrity incidents until systems are updated.

How an attack unfolds

An attacker with local access crafts a sequence of userfaultfd registrations and UFFDIO_MOVE operations on huge pages, forces a failure path after the metadata change but before the pin is dropped, and leverages the resulting inconsistent folio state to trigger memory corruption or facilitate further attacks.

How to fix it

Upgrade the Linux kernel to version 6.8.8 or later, or apply commit df5f6e683e7f21a15d8be6e7a0c7a46436963ebe. Reboot after installation and verify the running kernel contains the fix.

How to confirm the fix worked

Confirm the installed kernel is at least 6.8.8; inspect /proc/version or uname output and cross-check against the fixed commit hash in the kernel source tree.

Typical attack path

1. Obtain local execution on a vulnerable kernel
2. Register userfaultfd and map a huge-page region
3. Issue UFFDIO_MOVE while inducing a failure condition
4. Trigger subsequent swap or migration activity on the corrupted folio
5. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Examine kernel logs (dmesg, /var/log/kern.log) for userfaultfd-related warnings, folio corruption messages, or unexpected migration failures; correlate with process activity that registers userfaultfd on huge-page mappings.

What your security team should do

• Prioritize kernel updates on all systems that expose userfaultfd to untrusted processes
• Apply the patch or upgrade within standard change windows; treat as high priority for environments using memory-migration features
• Review and restrict userfaultfd usage via seccomp or LSM policies where the feature is not required
• Monitor vendor advisories for backported fixes in supported distribution kernels