CVE-2024-41027

What it actually does

The userfaultfd_api silently accepts requests for features absent from the kernel configuration and returns the set of available features instead of returning EINVAL, allowing subsequent operations such as UFFD_FEATURE_WP_UNPOPULATED to reach code paths that emit warnings (e.g., zap_pte_range) and produce inconsistent behavior.

Why it matters to the business

Linux systems may experience unexpected kernel warnings, application misbehavior when using advanced memory-management features, and reduced reliability of workloads that depend on precise userfaultfd semantics, potentially affecting stability across servers and embedded devices.

How an attack unfolds

An attacker invokes userfaultfd_api requesting a feature such as UFFD_FEATURE_WP_UNPOPULATED on a kernel compiled without the corresponding configuration option; the call returns success with a reduced feature mask instead of EINVAL, after which later memory operations trigger the warning path in zap_pte_range and may expose the system to follow-on instability or information leaks.

How to fix it

Upgrade the Linux kernel to a version containing commit 519547760f16eae7803d2658d9524bc5ba7a20a7 or later; rebuild and redeploy with the correct configuration options enabled for required userfaultfd features; verify the change by confirming that requests for unsupported features now return EINVAL.

How to confirm the fix worked

After applying the fixed commit, compile a test program that requests an unsupported feature and confirm EINVAL is returned; inspect kernel logs for absence of the zap_pte_range warning when the same request is made; run regression tests covering userfaultfd_api callers.

Typical attack path

1. Locate or compile a Linux kernel lacking the UFFD_FEATURE_WP_UNPOPULATED configuration option
2. Invoke userfaultfd_api with the unsupported feature bit set
3. Observe silent acceptance and receipt of the available feature mask instead of EINVAL
4. Perform subsequent userfaultfd operations that exercise the mismatched feature state
5. Trigger the warning in zap_pte_range and any resulting side effects

How to detect it

Search kernel logs and dmesg output for the zap_pte_range warning string and associated userfaultfd process names; review audit logs for calls to userfaultfd_api that receive non-error return values when requesting features not present in the running kernel configuration; examine any crash dumps or kdump artifacts generated after such calls.

What your security team should do

• Prioritize kernel upgrades containing commit 519547760f16eae7803d2658d9524bc5ba7a20a7 on all affected Linux distributions
• Audit applications that call userfaultfd_api and ensure they correctly handle EINVAL returns
• Enable kernel configuration options for all features that production workloads require
• Monitor kernel logs for zap_pte_range warnings as a temporary detection signal
• Track downstream package updates from distributions that incorporate the referenced commit