CVE-2024-41055

What it actually does

Race condition allows pfn_section_valid() to read a NULL ms->usage pointer via READ_ONCE without a subsequent NULL check before dereference, leading to kernel NULL pointer dereference in sparsemem handling.

Why it matters to the business

Kernel crashes or system instability on Linux systems during memory section deactivation under concurrent access, potentially causing denial of service and requiring reboots; widespread impact given Linux kernel prevalence in servers and cloud infrastructure.

How an attack unfolds

An attacker with local access triggers concurrent memory section operations to race section_deactivate() clearing ms->usage against pfn_section_valid(), causing the NULL dereference; listed threat actors in 2024 zero-day campaigns and Linux kernel exploitation could attempt to weaponize for local DoS or escalation.

How to fix it

Update Linux kernel to fixed versions including 5.10.222 or commit 0100aeb8a12d51950418e685f879cc80cb8e5982 in stable trees; apply the patch that adds a NULL check after the READ_ONCE on ms->usage.

How to confirm the fix worked

Confirm kernel version is at or above the fixed releases; review source for the added NULL check on ms->usage in pfn_section_valid(); test under memory hotplug or section deactivation workloads.

Typical attack path

1. Obtain local code execution on a vulnerable Linux kernel
2. Allocate and manipulate memory sections to trigger sparsemem paths
3. Race section_deactivate() with pfn_section_valid() calls
4. Trigger NULL dereference to crash the kernel or attempt further exploitation

How to detect it

Search kernel logs for NULL pointer dereference oops in pfn_section_valid or sparsemem paths; look for crashes coinciding with memory hotplug or section deactivation events.

What your security team should do

• Prioritize kernel upgrades on all affected Linux systems to the listed fixed versions
• Monitor for kernel oops or NULL dereference panics in system logs
• Restrict unprivileged local access where possible until patched