CVE-2024-40915

What it actually does

The __kernel_map_pages() debug function on RISC-V acquires init_mm's semaphore via __set_memory() which may sleep, but the function can be invoked from atomic contexts such as page allocator paths during process creation.

Why it matters to the business

Kernel warnings or crashes during routine memory operations on RISC-V systems can reduce availability and complicate debugging in production environments; the issue affects a narrow set of Linux kernel deployments.

How an attack unfolds

An attacker triggers memory allocation paths that invoke __kernel_map_pages() while in atomic context, causing the kernel to attempt sleeping and trigger warnings or potential instability; no targeted exploitation by named actors is associated with this specific flaw.

How to fix it

Update the Linux kernel to commit 919f8626099d9909b9a9620b05e8c8ab06581876 or later stable releases that rewrite __kernel_map_pages() to use apply_to_existing_page_range() without locking.

How to confirm the fix worked

Confirm the presence of commit 919f8626099d9909b9a9620b05e8c8ab06581876 in the kernel source; test by exercising kthreadd and vmalloc paths under memory pressure on RISC-V and verify absence of the sleeping-while-atomic warning.

Typical attack path

1. Trigger kernel memory allocation from atomic context on RISC-V
2. Invoke __kernel_map_pages() during page deallocation marking
3. Acquire semaphore inside __set_memory() leading to sleep attempt
4. Hit BUG warning or potential system instability

How to detect it

Search kernel logs and dmesg for the exact sleeping function warning referencing rwsem.c and __kernel_map_pages; inspect call traces involving kthreadd, copy_process, and __alloc_pages_bulk on RISC-V systems.

• BUG: sleeping function called from invalid context at kernel/locking/rwsem.c
• __kernel_map_pages+0x5a/0xd4
• kthreadd
• ret_from_fork

What your security team should do

• Prioritize patching RISC-V Linux kernels to the fixed commit within normal maintenance windows
• Monitor kernel logs for sleeping function warnings during allocation paths
• Limit use of kernel debug features that enable __kernel_map_pages() in production