CVE-2024-44965

What it actually does

pti_clone_pgtable() assumes PMD alignment on the start address, which holds on x86_64 but not i386; the resulting short clone leaves an incomplete copy of entry text in the user mapping, causing repeated traps that exhaust the entry stack and trigger a double fault.

Why it matters to the business

32-bit x86 Linux systems may suffer sudden crashes and loss of availability, affecting workloads that rely on older i386 kernels or downstream packages such as heketi.

How an attack unfolds

An attacker with local access on an affected i386 build performs memory-mapping or context-switch operations that invoke pti_clone_pgtable() with a non-PMD-aligned address; the malformed clone leaves entry-text unmapped, leading to repeated faults that exhaust the stack and produce a double-fault denial of service.

How to fix it

Apply the upstream fix (commit 18da1b27ce16a14a9b636af9232acb4fb24f4c9e) or upgrade to a kernel containing that change; for the heketi package, upgrade to version 10.1.0.

How to confirm the fix worked

Confirm the running kernel contains commit 18da1b27ce16a14a9b636af9232acb4fb24f4c9e or later; on i386 builds, exercise pti_clone_pgtable() paths and verify no short clones or double-fault panics occur.

Typical attack path

1. Identify an i386 Linux system without the alignment fix
2. Trigger page-table cloning via mmap, exec, or context-switch paths
3. Supply a start address that violates the PMD-alignment assumption
4. Induce repeated traps that exhaust the entry stack
5. Cause #DF and kernel panic or hang

How to detect it

Review kernel logs for repeated traps, entry-stack exhaustion messages, or double-fault (#DF) panics on i386 systems; correlate with processes that perform heavy memory-mapping or context switching.

What your security team should do

• Patch all 32-bit x86 Linux kernels to the fixed commit or later release
• Prioritize systems exposed to local users or untrusted workloads
• Re-test stability after applying the update on representative i386 hardware
• Monitor vendor advisories for any additional back-ports