CVE-2024-40917

What it actually does

memblock_set_node() accepts MAX_NUMNODES without warning or clamping, allowing subsequent memblock_alloc_range_nid() paths to reach memmap_init() with an out-of-range node index and trigger a NULL pointer dereference.

Why it matters to the business

Systems with certain NUMA memory maps above 4 GB may experience kernel crashes during early boot or memory initialization, causing unplanned downtime on affected Linux deployments.

How an attack unfolds

An attacker with the ability to influence early kernel memory layout or boot parameters on a vulnerable x86 NUMA system triggers the unhandled MAX_NUMNODES path, resulting in a NULL dereference during node data access.

How to fix it

Upgrade to Linux kernel 6.6.72 or apply commit 4ddb7f966f3d06fcf1ba5ee298af6714b593584b (or later stable backports) that adds the missing MAX_NUMNODES handling in memblock_set_node().

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases, then verify memblock_set_node() contains the new warning-and-clamp logic for MAX_NUMNODES via source inspection or kernel log checks during NUMA initialization.

Typical attack path

1. Boot or initialize kernel on x86 system whose SRAT only covers memory above 4 GB
2. memblock_validate_numa_coverage() accepts configuration instead of rejecting it
3. memblock_set_node() stores MAX_NUMNODES without adjustment
4. memblock_alloc_range_nid() later dereferences node data for index 64
5. NULL pointer dereference occurs in memmap_init()

How to detect it

Inspect kernel boot logs and dmesg for MAX_NUMNODES warnings or NUMA coverage messages on x86 systems; correlate with crashes in memmap_init() or memblock paths.

What your security team should do

• Prioritize patching production kernels that match the affected NUMA configurations within the next maintenance window
• Monitor boot logs for MAX_NUMNODES warnings after applying the fix
• Review downstream distribution packages for equivalent backports