CVE-2024-42267

What it actually does

Missing case for VM_FAULT_SIGSEGV in RISC-V mm_fault_error() causes the kernel to BUG() instead of delivering SIGSEGV to the process.

Why it matters to the business

Unexpected kernel crashes on RISC-V systems during certain memory faults reduce availability; high ecosystem prevalence across 25,114 downstream dependents amplifies operational risk for Linux deployments.

How an attack unfolds

An attacker triggers a page fault returning VM_FAULT_SIGSEGV on an unpatched RISC-V Linux kernel, causing the kernel to panic rather than terminating the process.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit 59be4a167782d68e21068a761b90b01fadc09146 (or equivalent stable release such as 6.5.7 where applicable).

How to confirm the fix worked

Confirm the mm_fault_error() function contains the VM_FAULT_SIGSEGV handler and reproduce page-fault scenarios on RISC-V hardware or emulators to verify no BUG() occurs.

Typical attack path

1. Craft or induce a memory access that produces VM_FAULT_SIGSEGV on RISC-V
2. Allow the page-fault error path to execute without the missing case
3. Trigger kernel BUG() resulting in panic or denial of service

How to detect it

Review kernel logs for BUG() entries originating from the page-fault error path on RISC-V systems; correlate with process termination attempts that instead produce kernel panics.

What your security team should do

• Apply the referenced kernel commit or later release on all RISC-V systems
• Include RISC-V kernels in regular patch management cadence
• Test memory-fault workloads in staging before production rollout