CVE-2024-53109

What it actually does

In nommu Linux kernels, vma deletion from a maple tree passed an incorrect argument to vma_iter_prealloc(), leaving the iterator in an invalid state and causing subsequent accesses (such as acct_collect() reading VMA sizes after do_munmap()) to crash.

Why it matters to the business

Nommu-based embedded or specialized Linux systems experience unexpected kernel crashes during routine memory operations, leading to service interruptions and potential loss of in-flight work; older Ubuntu LTS releases are affected but long past end-of-life.

How an attack unfolds

An attacker with local execution on a vulnerable nommu kernel triggers memory unmapping operations that invoke the flawed vma deletion path; the resulting invalid iterator state causes a kernel crash when other code later dereferences the iterator.

How to fix it

Upgrade to the following fixed package versions: linux 3.13.0-101.148, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-lts-xenial 4.4.0-24.43~14.04.1, linux 4.4.0-24.43, linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-raspi2 4.4.0-1012.16, linux-snapdragon 4.4.0-1015.18, linux-lts-vivid 3.19.0-61.69~14.04.1, linux-lts-wily 4.2.0-38.45~14.04.1.

How to confirm the fix worked

Confirm the running kernel package version matches or exceeds one of the listed fixed releases; test by exercising do_munmap() followed by acct_collect() or equivalent VMA iteration on a nommu configuration.

Typical attack path

1. Obtain local code execution on a nommu Linux system
2. Perform memory-mapping and unmapping sequences that delete VMA entries
3. Trigger code paths such as acct_collect() that access the corrupted vma iterator
4. Kernel crashes due to invalid memory access

How to detect it

Inspect kernel logs and crash dumps for faults involving vma_iter_prealloc, maple tree VMA deletion, or acct_collect after munmap operations; correlate with process activity that performs heavy memory mapping/unmapping.

What your security team should do

• Immediately upgrade affected Ubuntu 14.04/16.04 kernel packages to the listed fixed versions
• Migrate nommu workloads to supported kernel releases or non-nommu configurations where feasible
• Monitor kernel crash logs for VMA iterator dereference faults on remaining vulnerable systems