CVE-2024-42293

What it actually does

Incorrect p4d_offset_lockless implementation on arm64 with runtime-folded 4-level page tables causes pud_offset_lockless to compute addresses from a stack-allocated pgd_t instead of the real page-table page, resulting in invalid memory accesses during lockless GUP walks.

Why it matters to the business

Kernel oopses and potential system instability on affected arm64 configurations using 16K pages without LPA2, increasing crash rates and operational risk for Linux deployments until patched.

How an attack unfolds

An attacker triggers fast GUP operations (via user-space memory access patterns) on a vulnerable arm64 kernel configured for 16K pages with dynamic page-table folding; the resulting stray stack read can produce invalid page-table pointers that crash the kernel or, in theory, allow limited memory corruption.

How to fix it

Upgrade Linux kernel to version 6.10.3 or later, or apply commit 78672d49d3eebbcda3589f4d6e589caf357c5a59 on affected stable branches; rebuild and reboot with the corrected p4d_offset_lockless definition.

How to confirm the fix worked

Confirm running kernel version >= 6.10.3 or contains the referenced commit; on test systems, enable 16K pages without LPA2 and exercise GUP-heavy workloads to verify absence of related oopses.

Typical attack path

1. Identify or force arm64 system into 16K page + 4-level folded configuration
2. Perform sequences of user-space memory operations that invoke get_user_pages_fast
3. Cause GUP fast-path to execute p4d_offset_lockless followed by pud_offset_lockless
4. Trigger invalid stack-based address calculation leading to oops or corruption

How to detect it

Search kernel logs (dmesg, journalctl) for oops traces originating from gup_fast_pgd_range or page-table offset functions on arm64 hosts; correlate with systems reporting 16K page usage and 4-level folding.

What your security team should do

• Prioritize kernel upgrades on all arm64 systems using 16K pages within the next maintenance window
• Monitor for kernel oops reports referencing GUP or page-table folding after patching
• Review downstream distributions for backported fixes and schedule fleet-wide reboots