CVE-2024-39477

What it actually does

The kernel fails to handle -ENOMEM from vma_needs_reservation() in hugetlb code paths, causing region_abort/region_del to observe an empty file_region list and leaving the hugetlb_restore_reserve flag in an inconsistent state so that free_huge_folio() incorrectly adjusts the reservation count.

Why it matters to the business

Local workloads that allocate or unmap huge pages under memory pressure can trigger kernel warnings, crashes, or system instability, forcing unplanned reboots and interrupting services that rely on hugetlbfs.

How an attack unfolds

An attacker with local access crafts a sequence of hugetlb mmap/munmap operations that force allocate_file_region_entries() to fail; the missing ENOMEM check then leaves the reservation state corrupted, resulting in a splat inside __unmap_hugepage_range() or subsequent free operations.

How to fix it

Upgrade the Linux kernel to 6.9.5 or later, or apply commit aa998f9dcb34c28448f86e8f5490f20d5eb0eac7; rebuild and reboot all affected hosts. Where immediate patching is impossible, restrict unprivileged hugetlb usage via sysctl vm.hugetlb_shm_group or cgroups.

How to confirm the fix worked

After upgrade, confirm the kernel version contains the fix commit; run existing hugetlb stress tests under memory pressure and verify absence of the __unmap_hugepage_range splat; check dmesg for the prior warning pattern.

Typical attack path

1. Obtain local shell or process execution on the target system
2. Map hugetlb-backed regions while driving the system into low-memory conditions
3. Trigger vma_needs_reservation() failure and subsequent unmap path
4. Observe kernel splat or system crash

How to detect it

Search kernel logs for the __unmap_hugepage_range splat and the associated reservation error messages; correlate with processes performing hugetlb mmap/munmap while the system is under memory pressure.

What your security team should do

• Prioritize patching of internet-facing or multi-tenant systems within the next maintenance window
• Apply the fixed kernel package or commit listed for each distribution
• Limit hugetlb access to trusted users until patches are deployed
• Monitor EPSS and exploit maturity; no KEV entry exists at this time