CVE-2024-40948

What it actually does

Page table checker assumes every page has a page_ext structure but ZONE_DEVICE pages map PFNs directly without allocating page_ext, triggering a kernel BUG at mm/page_table_check.c:55 when set_pxx_at is used for DAX mappings.

Why it matters to the business

Systems using DAX or persistent memory with page-table-check enabled can experience repeated kernel crashes and denial of service; low urgency given minimal EPSS, no KEV listing, and no ransomware use despite broad Linux kernel exposure.

How an attack unfolds

An attacker maps DAX memory regions on a system with both ZONE_DEVICE and page-table-check enabled, causing the kernel to invoke page-table checks during pfn mapping in page fault resolution and hit the unconditional BUG.

How to fix it

Upgrade to fixed package versions: webkit2gtk (Debian:11) 2.44.2-1~deb11u1, webkit2gtk (Debian:12) 2.44.2-1~deb12u1, webkit2gtk (Debian:13) 2.44.2-1, wpewebkit (Debian:13) 2.44.2-1; apply corresponding kernel updates that include the page_table_check fix and verify page_ext existence before checks.

How to confirm the fix worked

Confirm the patch is present by checking that page_table_check skips ZONE_DEVICE pages without page_ext; test DAX memory mapping workloads to ensure no BUG at mm/page_table_check.c:55 occurs.

Typical attack path

1. Identify or configure a Linux system with ZONE_DEVICE support and page-table-check enabled
2. Trigger devm_memremap_pages or equivalent DAX memory mapping
3. Force page fault resolution that calls set_pte_at on the ZONE_DEVICE PFN
4. Kernel reaches page_table_check.c:55 and panics

How to detect it

Search kernel logs and dmesg for the string 'kernel BUG at mm/page_table_check.c:55' and any preceding DAX or ZONE_DEVICE mapping attempts; correlate with process activity that accesses persistent memory devices.

• kernel BUG at mm/page_table_check.c:55
• page_table_check
• ZONE_DEVICE

What your security team should do

• Prioritize patching affected Debian webkit2gtk and wpewebkit packages to the listed fixed versions
• Review kernel configuration and disable page-table-check if DAX/ZONE_DEVICE usage is required and the fix cannot be applied immediately
• Monitor kernel logs for page_table_check crashes as an indicator of exposure