CVE-2024-36881

What it actually does

Incomplete cleanup of write-protect bits in page table entries on userfaultfd close() instead of only UFFDIO_UNREGISTER, leaving stale uffd-wp bits that later page-table sanity checks can flag without VMA context.

Why it matters to the business

Kernel warnings or potential instability on systems using userfaultfd write-protection features; low public exploitability reduces immediate risk but still requires patching for memory-management correctness in Linux environments.

How an attack unfolds

An attacker with local access triggers userfaultfd registration with write protection, performs operations that set wr-protect bits, then closes the descriptor; the missing reset leaves invalid PTE state that subsequent page-table checks may detect, producing warnings or invalid fault reports.

How to fix it

Upgrade the Linux kernel to a version containing commit 377f3a9a3d032a52325a5b110379a25dd1ab1931 or later; rebuild and reboot with the patched kernel; apply vendor backports if using distribution kernels.

How to confirm the fix worked

Confirm the running kernel git commit or version string contains 377f3a9a3d032a52325a5b110379a25dd1ab1931; exercise userfaultfd close paths under memory-pressure workloads and verify absence of page_table_check warnings related to uffd-wp bits.

Typical attack path

1. Obtain local code execution or user privileges on a Linux system
2. Register a userfaultfd with UFFD_FEATURE_WP_HUGETLBFS_SHMEM or similar write-protect capability
3. Map memory and set wr-protect bits via UFFDIO_WRITEPROTECT
4. Close the userfaultfd file descriptor without an explicit UFFDIO_UNREGISTER ioctl
5. Trigger page-table checks or further memory operations that validate uffd-wp bits

How to detect it

Search kernel logs for page_table_check or userfaultfd-related warnings mentioning leftover wr-protect bits; review auditd or syscall traces for userfaultfd close operations followed by unexpected fault handling.

What your security team should do

• Prioritize kernel upgrades on systems that actively use userfaultfd write protection (containers, sandboxes, live-migration tooling)
• Monitor vendor kernel update channels for backported fixes
• Test patched kernels in staging environments that exercise userfaultfd before broad deployment