CVE-2024-53113

What it actually does

NULL pointer dereference in alloc_pages_bulk_noprof() when ac.preferred_zoneref->zone becomes NULL due to concurrent nodemask modification during cpuset migration in prepare_alloc_pages() and first_zones_zonelist().

Why it matters to the business

Local denial of service causing kernel crashes or system instability on affected Linux systems, especially those using cpusets or NUMA configurations; no remote code execution or data loss risk.

How an attack unfolds

An attacker with local access triggers repeated task migration between cpusets while memory allocation code runs, causing the nodemask to change mid-traversal of the zonelist so that preferred_zoneref points to a NULL zone; subsequent calls in for_each_zone_zonelist_nodemask() then dereference the NULL pointer.

How to fix it

Update the Linux kernel to commit 903d896448c2e50e8652aaba529a30d4d1eaa0e5 or later; apply the equivalent fix present in stable releases that backport the NULL check for preferred_zoneref->zone.

How to confirm the fix worked

Verify the running kernel contains the NULL-pointer check in alloc_pages_bulk_noprof() and prepare_alloc_pages(); confirm no oops involving preferred_zoneref or alloc_pages_bulk after applying the update.

Typical attack path

1. Obtain local code execution on a target system with cpusets enabled
2. Trigger concurrent cpuset migration for the allocating task
3. Force memory allocation paths that invoke alloc_pages_bulk_noprof()
4. Induce NULL dereference leading to kernel panic or oops

How to detect it

Search kernel logs and crash dumps for stack traces containing alloc_pages_bulk_noprof, prepare_alloc_pages, first_zones_zonelist, or NULL pointer dereference messages mentioning preferred_zoneref or zonelist_node_idx.

• alloc_pages_bulk_noprof
• preferred_zoneref->zone
• NULL pointer dereference
• for_each_zone_zonelist_nodemask

What your security team should do

• Prioritize kernel updates on all systems using cpusets or NUMA
• Reboot after applying the fixed kernel package
• Monitor for kernel oops reports referencing alloc_pages_bulk_noprof until patched
• Review cpuset usage and consider disabling if not required on high-risk hosts