CVE-2024-47755

What it actually does

Memory leak in nvdimm scan_labels() path when label scanning fails and fallback seed namespace creation occurs, allowing unbounded kernel memory consumption triggered by root.

Why it matters to the business

Systems using NVDIMM devices can experience gradual memory exhaustion leading to instability, degraded performance, or crashes, increasing operational risk on Debian-based deployments until patched.

How an attack unfolds

An attacker with root privileges repeatedly triggers label scan failures during nvdimm region probing, causing the kernel to allocate objects that are never freed and exhaust available memory over time.

How to fix it

Upgrade the linux package on Debian 13 to version 6.11.2-1 or later; reboot after installation to load the corrected kernel.

How to confirm the fix worked

Verify running kernel version is at least 6.11.2-1; monitor kmemleak output for unreferenced nvdimm objects after device registration; confirm absence of repeated leaks under normal probe workloads.

Typical attack path

1. Obtain root access on target system
2. Trigger repeated nvdimm region registration or device probe events that invoke scan_labels()
3. Force label scanning failure paths to activate fallback seed namespace creation
4. Repeat until kernel memory is exhausted and system becomes unstable

How to detect it

Search system logs and kmemleak reports for unreferenced objects allocated during nd_region_register_namespaces or nvdimm_bus_probe; monitor for unexpected OOM killer activity correlated with NVDIMM device attachment.

What your security team should do

• Immediately schedule kernel upgrade to 6.11.2-1 across all affected Debian 13 hosts
• Prioritize systems with NVDIMM hardware for patching due to direct exposure
• Enable kmemleak or similar memory debugging in test environments to validate the fix
• Review and restrict unnecessary root-level access that could trigger device reprobing