CVE-2024-42316

What it actually does

Underflow of scan_control->nr_scanned in evict_folios() during memory reclaim can cause a zero divisor in vmpressure_calc_level(), triggering a kernel crash in vmpressure_work_fn.

Why it matters to the business

Local denial of service that can crash systems under memory pressure, leading to downtime and potential data loss in affected Linux environments with 281 downstream dependents increasing exposure.

How an attack unfolds

An attacker with local access triggers memory reclaim paths involving folio writeback and lock contention so that nr_scanned underflows, causing division by zero during vmpressure calculations; listed threat actors have targeted similar Linux kernel issues in espionage and financially motivated campaigns.

How to fix it

Update to fixed kernel versions that remove the nr_scanned deduction in evict_folios(); note that listed sqlparse fixes to 0.5.0 do not apply to this kernel issue.

How to confirm the fix worked

Confirm kernel version is newer than the vulnerable commit, reproduce memory pressure workloads, and verify vmpressure_work_fn no longer crashes on zero scale.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Induce memory pressure or specific reclaim conditions involving dirty folios and writeback
3. Force folio_trylock failures during shrink_folio_list to create nr_scanned underflow
4. Trigger vmpressure_calc_level with zero divisor to crash the kernel

How to detect it

Review kernel logs for vmpressure_work_fn exceptions or RIP crashes during memory reclaim; correlate with threat actor TTPs targeting Linux kernel resource issues.

What your security team should do

• Prioritize patching production kernels within the CISA-style remediation window given listed threat actor activity
• Monitor for local memory-pressure workloads that could be abused
• Test the fix under reclaim-heavy scenarios before broad deployment