CVE-2024-42234

What it actually does

Race condition in Linux kernel mm subsystem between deferred_split_scan() and folio_migrate_mapping() allows concurrent modification of folio state (including _deferred_list and refcount) without proper serialization, resulting in double-free, bad page state, and VM_BUG_ON_PAGE assertions during large folio operations.

Why it matters to the business

Unpatched Linux systems may experience unexpected kernel crashes and service restarts under memory pressure or migration workloads, leading to unplanned downtime; the issue affects widely deployed kernel versions but carries low remote exploit risk.

How an attack unfolds

An attacker with local code execution triggers large folio allocation, migration, and deferred splitting in rapid succession; the window created by folio_try_get() and the local list in deferred_split_scan() permits the folio to be freed twice or left in an inconsistent state, crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit fc7facce686b64201dbf0b9614cc1d0bfad70010 or later; rebuild and reboot with the patched kernel. For packaged distributions apply the vendor update that resolves the deferred split race.

How to confirm the fix worked

Confirm the running kernel contains fc7facce686b or a backported equivalent; exercise folio migration and deferred split workloads while monitoring for absence of 'Bad page state' and VM_BUG_ON_PAGE(page_ref_count(page) == 0) messages.

Typical attack path

1. Obtain local user or container access on an affected Linux host
2. Allocate and manipulate large folios while inducing memory pressure or NUMA migration
3. Force concurrent deferred split queue processing and folio migration
4. Trigger double-free or invalid page state leading to kernel panic or BUG

How to detect it

Search kernel logs (dmesg, journalctl) for strings indicating bad page state during folio_put or deferred_split_scan, VM_BUG_ON_PAGE assertions, and double-free warnings; correlate with processes performing memory migration or THP activity.

• Bad page state
• deferred_split_scan
• folio_put
• VM_BUG_ON_PAGE(page_ref_count(page) == 0)

What your security team should do

• Prioritize kernel updates on systems handling large memory workloads or containers
• Schedule reboot windows for production hosts after applying the fixed commit
• Monitor kernel logs for deferred_split_scan and folio_put related crashes until patched