CVE-2024-46838

What it actually does

Incorrect BUG_ON assertions in userfaultfd can be triggered when khugepaged retracts page tables from file mappings without holding the mmap lock, leading to kernel panics under valid race conditions involving transhuge pages.

Why it matters to the business

Linux systems may experience unexpected kernel crashes or instability during memory management with userfaultfd and huge pages, impacting service availability; low urgency as the issue is not known to be exploited in the wild and EPSS remains minimal.

How an attack unfolds

An attacker triggers a race between khugepaged page-table retraction in file mappings and concurrent userfaultfd operations to hit the erroneous BUG_ON checks and cause a kernel panic.

How to fix it

Upgrade the Linux kernel to commit 4a594acc12d5954cdc71d4450a386748bf3d136a or a later stable release that removes the incorrect BUG_ON checks.

How to confirm the fix worked

Confirm the running kernel source includes the commit removing the BUG_ON statements in the userfaultfd code paths and test that the prior assertion conditions no longer panic the kernel.

Typical attack path

1. Identify a system running a vulnerable Linux kernel version
2. Establish file mappings that can be retracted by khugepaged
3. Perform concurrent userfaultfd operations to create the race window
4. Force the retraction path to trigger the BUG_ON assertion

How to detect it

Review kernel logs for BUG or panic messages referencing userfaultfd or page-table retraction; compare running kernel commit IDs against the fixed version.

What your security team should do

• Prioritize kernel updates on all affected Linux distributions
• Validate the fix in staging environments that exercise userfaultfd and khugepaged workloads
• Monitor kernel stability metrics after deployment