CVE-2024-49872

What it actually does

Race condition in Linux kernel mm/gup memfd_pin_folios where an -EEXIST error from memfd_alloc_folio during hugetlb allocation is not followed by setting folio to NULL, causing a subsequent folio_put in the while loop to panic.

Why it matters to the business

Kernel panics leading to system crashes and denial of service on Linux hosts performing concurrent memfd operations with hugetlb pages; low exploitation probability but high impact on availability for affected workloads.

How an attack unfolds

An attacker triggers concurrent hugetlb page creation via memfd while the target process executes memfd_pin_folios; the first allocation succeeds, the second returns -EEXIST, the error is ignored without resetting the folio pointer, and the next loop iteration dereferences an invalid pointer resulting in panic. Listed threat actors reference broad Linux kernel campaigns but no specific exploitation of this race is known.

How to fix it

Apply the upstream fix that sets folio to NULL after handling -EEXIST in memfd_pin_folios; upgrade to a patched Linux kernel release containing the mm/gup.c change.

How to confirm the fix worked

Review mm/gup.c for the NULL assignment after the -EEXIST check; run stress tests exercising concurrent memfd_pin_folios with hugetlb to confirm absence of panic.

Typical attack path

1. Identify Linux systems running vulnerable kernel versions with memfd and hugetlb usage
2. Craft or trigger concurrent memfd allocation workloads that race on hugetlb folio creation
3. Force the allocation path to return -EEXIST without clearing the folio variable
4. Advance the loop to execute folio_put on the stale pointer and induce kernel panic

How to detect it

Search kernel logs and crash dumps for strings referencing memfd_pin_folios, memfd_alloc_folio, and folio_put around the time of panics; correlate with processes using memfd_create and hugetlb.

What your security team should do

• Prioritize kernel updates on systems using memfd and hugetlb pages given the panic risk
• Monitor kernel logs for memfd_pin_folios and folio_put related oops or panic messages
• Limit untrusted code from performing memfd operations until patches are applied