CVE-2024-50219

What it actually does

GFP_ATOMIC order-0 allocations fail under memory pressure despite available pages in highatomic reserves because such allocations cannot invoke unreserve_highatomic_pageblock() which only runs during reclaim; the fix allows these allocations to fall back to highatomic reserves like ALLOC_OOM does.

Why it matters to the business

Network-intensive workloads on affected Linux systems can experience unexpected allocation failures leading to packet drops, service degradation, or kernel warnings during sustained memory pressure, increasing operational risk for servers and cloud fleets until patched.

How an attack unfolds

An attacker generates memory pressure on the target system while sending network traffic that triggers order-0 GFP_ATOMIC allocations in drivers such as bnxt_en; the kernel's inability to access highatomic reserves causes allocation failures visible in kswapd and napi paths, resulting in denial of service without requiring code execution.

How to fix it

Upgrade to a fixed kernel version for each affected Ubuntu release: linux 3.13.0-83.127 (14.04), linux-aws 4.4.0-1002.2 (14.04), linux-lts-xenial 4.4.0-13.29~14.04.1, linux 4.4.0-7.22 (16.04), linux-aws 4.4.0-1001.10 (16.04), linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-raspi2 4.4.0-1003.4, linux-snapdragon 4.4.0-1012.12, and corresponding lts-utopic/vivid/wily backports; reboot after installation.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the listed fixed packages; reproduce memory pressure with network traffic and confirm absence of "page allocation failure: order:0, mode:0x820(GFP_ATOMIC)" warnings in dmesg or syslog.

Typical attack path

1. Establish conditions that create sustained memory pressure on the victim host
2. Send high volumes of network packets that require order-0 GFP_ATOMIC skb allocations
3. Trigger __alloc_pages_slowpath paths that check watermarks but cannot fall back to highatomic reserves
4. Observe page allocation failure warnings and subsequent packet processing failures

How to detect it

Search kernel logs and dmesg for repeated "page allocation failure: order:0, mode:0x820(GFP_ATOMIC)" entries accompanied by stack traces involving __napi_alloc_skb, bnxt_rx_page_skb, or net_rx_action during periods of high network load or memory pressure.

• page allocation failure: order:0, mode:0x820(GFP_ATOMIC)
• warn_alloc+0x13a/0x1c0
• __alloc_pages_slowpath.constprop.0+0xc9d/0xd10
• kswapd.*page allocation failure

What your security team should do

• Apply the listed kernel updates immediately on all affected Ubuntu 14.04 and 16.04 systems
• Prioritize patching of network-facing servers and cloud instances first
• Enable monitoring for GFP_ATOMIC allocation failure logs as a temporary detection control
• Schedule kernel upgrades as part of standard maintenance to reduce future exposure