CVE-2024-36891

What it actually does

Null pointer dereference in maple_tree mas_empty_area_rev() when mas_start() returns a maple state with node == NULL, followed by mas_data_end() accessing the NULL node, resulting in kernel oops.

Why it matters to the business

Local users can trigger kernel crashes on affected Linux systems, causing denial of service and potential system instability; high ecosystem prevalence in Linux distributions increases operational disruption risk for servers and devices.

How an attack unfolds

An attacker with local access unmaps all VMAs to create an empty maple tree then maps a new VMA to trigger the mas_empty_area_rev() code path that dereferences a NULL node after mas_start() returns without a node.

How to fix it

Update the Linux kernel to the fixed commit 883e5d542bbdddbddeba60250cb482baf3ae2415 or later stable releases containing the maple tree null-check fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 883e5d542bbdddbddeba60250cb482baf3ae2415; attempt reproduction of empty maple tree scenarios in a test environment and verify no oops occurs.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Unmap all existing VMAs to produce an empty maple tree
3. Map a new VMA that exercises the empty-area reverse search path
4. Trigger mas_start() returning NULL followed by mas_data_end() dereference causing oops

How to detect it

Review kernel logs for oops traces mentioning maple_tree, mas_empty_area_rev, mas_start, or mas_data_end; correlate with processes performing extensive VMA unmap and remap operations.

What your security team should do

• Prioritize kernel upgrades to the listed fixed commit across all Linux fleets
• Monitor for kernel oops reports related to maple_tree in system logs
• Restrict unprivileged local access where possible until patched