CVE-2024-42233

What it actually does

Race condition in filemap_fault_recheck_pte_none allows use-after-free on a stale page table lock pointer after pte_unmap and rcu_read_unlock, because the pointer obtained via pte_offset_map is no longer valid.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption leading to limited integrity impact; organizations must apply kernel updates promptly despite low exploit likelihood to avoid future escalation risks in high-density or shared environments.

How an attack unfolds

An attacker with local access triggers filemap fault handling paths that perform pte_unmap followed by reuse of the previously captured ptl pointer; the window allows the page table to be freed or altered, resulting in dereference of a dangling lock and potential UAF write.

How to fix it

Upgrade the Linux kernel to commit 6a6c2aec1a89506595801b4cf7e8eef035f33748 or later; AlmaLinux users should update lshw and lshw-gui packages to B.02.19.2-6.el8 or newer equivalent that incorporates the fix.

How to confirm the fix worked

Confirm kernel version contains commit 6a6c2aec1a89506595801b4cf7e8eef035f33748; review source for replacement of pte_offset_map with pte_offset_map_nolock in filemap_fault_recheck_pte_none; run regression tests exercising concurrent filemap faults.

Typical attack path

1. Obtain local code execution on an affected Linux system
2. Craft workload that exercises filemap_fault_recheck_pte_none under concurrent page table modifications
3. Trigger the stale PTL dereference to induce UAF
4. Leverage resulting memory corruption for limited integrity violation or to attempt further privilege escalation

How to detect it

Examine kernel logs for page fault and UAF-related oops or warning messages around filemap and pte handling; no public exploit artifacts are known, so focus on post-patch verification rather than historical indicators.

What your security team should do

• Prioritize kernel updates on all Linux hosts within standard change windows
• Monitor EPSS and KEV status for any future increase in exploit activity
• Restrict local untrusted code execution where feasible until patches are deployed