CVE-2024-35993

What it actually does

Race condition in folio_test_hugetlb allows concurrent folio split to return false positives for non-hugetlb folios when no refcount is held, leading to incorrect PageHuge checks and potential oops in compaction paths under CONFIG_DEBUG_VM.

Why it matters to the business

Linux systems may experience kernel crashes or instability during memory compaction, failure handling, or procfs access on workloads using huge pages, increasing downtime risk especially on servers with high memory pressure.

How an attack unfolds

An attacker with local code execution crafts concurrent memory operations involving folio splits while triggering paths in compaction, memory failure, or procfs that call the flawed hugetlb test without holding references, resulting in invalid assumptions and a kernel oops.

How to fix it

Update the Linux kernel to a version containing commit 2431b5f2650dfc47ce782d1ca7b02d6b3916976f or later; rebuild and reboot affected systems. Disable CONFIG_DEBUG_VM in production kernels as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Verify kernel source contains the PageType implementation for hugetlb test and that PageHuge no longer uses the old mapcount-based check; run targeted compaction and hugetlb stress tests with DEBUG_VM enabled to confirm absence of oops.

Typical attack path

1. Obtain local execution on target Linux system
2. Trigger or wait for folio split in hugetlbfs context
3. Invoke memory compaction or memory-failure handler without refcount
4. Cause PageHuge test to return incorrect result
5. Trigger VM_BUG_ON or invalid dereference leading to oops

How to detect it

Inspect kernel logs for oops traces referencing PageHuge, compaction, or memory-failure around hugetlb operations; correlate with procfs or hugetlbfs activity in system call traces.

What your security team should do

• Prioritize kernel updates on systems with CONFIG_HUGETLB_PAGE and compaction enabled
• Monitor for kernel oops in memory management paths post-deployment
• Review workloads using huge pages for exposure to concurrent split conditions