CVE-2024-49873

What it actually does

NULL pointer dereference in filemap_get_folios_contig when memfd_pin_folios receives a non-huge-page-aligned start offset on THP-backed memory, because xas_load returns an xarray sibling entry (value 2) instead of a valid folio, causing folio_try_get to crash.

Why it matters to the business

Local processes can trigger kernel panics leading to system reboots or denial of service; high ecosystem prevalence of the Linux kernel increases exposure across servers and containers.

How an attack unfolds

An attacker with local access invokes memfd_pin_folios (or equivalent userspace path) supplying an offset inside a THP range; the kernel loads a sibling xarray entry, skips the is_file_hugepages rounding that hugetlbfs receives, and dereferences an invalid folio pointer resulting in panic.

How to fix it

Apply the upstream fix that rounds THP indices to huge-page boundaries before calling filemap_get_folios_contig; rebuild and deploy the patched kernel; verify the change with the provided validation steps.

How to confirm the fix worked

Confirm the patch is present by checking the filemap.c source for the added sibling-entry test and early return of the next index; run a reproducer that passes an unaligned offset to memfd_pin_folios and verify no NULL dereference occurs.

Typical attack path

1. Obtain local code execution on a vulnerable Linux kernel
2. Create or open a memfd backed by transparent huge pages
3. Call memfd_pin_folios (or trigger the same path) with a start index not aligned to huge-page boundaries
4. Trigger the xas_load inside filemap_get_folios_contig that returns the sibling entry
5. Cause folio_try_get to dereference address 0x36 and panic the kernel

How to detect it

Search kernel logs for 'BUG: kernel NULL pointer dereference' with RIP pointing to filemap_get_folios_contig; inspect audit logs or strace output for memfd_create followed by memfd_pin_folios or similar huge-page operations with unaligned offsets.

• BUG: kernel NULL pointer dereference.*filemap_get_folios_contig
• filemap_get_folios_contig+0xdf
• xas_load.*sibling
• memfd_pin_folios.*THP

What your security team should do

• Prioritize kernel updates on systems that use memfd_pin_folios or THP-backed memfds
• Monitor for local privilege-escalation attempts that could abuse the panic path
• Restrict untrusted local code execution until patches are deployed