CVE-2024-56612

What it actually does

unpin_user_pages() does not skip NULL entries in the supplied pages array, causing a NULL pointer dereference inside sanity_check_pinned_pages when certain GUP long-term pinning paths are exercised.

Why it matters to the business

Kernel panic or denial of service on Linux systems that perform get_user_pages operations under specific memory configurations; widespread impact due to Linux kernel prevalence.

How an attack unfolds

An attacker crafts memory mappings or invokes GUP-related ioctls (such as those exercised by gup_longterm) that cause the kernel to insert a NULL page pointer into the array passed to unpin_user_pages, triggering the crash on the next sanity check.

How to fix it

Upgrade the Linux kernel to version 6.12.5 or later, or apply commit 69d319450d1c651f3b05cd820ff285fdd810c032 in the stable tree.

How to confirm the fix worked

Verify running kernel version is at least 6.12.5; re-run tools/testing/selftests/mm/gup_longterm under the same NUMA configuration and confirm absence of the NULL dereference oops.

Typical attack path

1. configure NUMA layout that triggers movable page migration (e.g., numa=fake + movablecore)
2. perform long-term GUP pinning via pin_user_pages or equivalent ioctl
3. force migration of pinned pages so that a NULL page entry reaches unpin_user_pages
4. trigger sanity_check_pinned_pages resulting in NULL dereference and kernel oops

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference combined with sanity_check_pinned_pages or unpin_user_pages call traces; inspect crash dumps for GUP long-term pinning paths.

• sanity_check_pinned_pages+0x3a
• unpin_user_pages+0x24
• check_and_migrate_movable_pages_or_folios
• BUG: kernel NULL pointer dereference, address: 0000000000000008

What your security team should do

• Patch kernels to 6.12.5+ immediately on all production systems
• Monitor for kernel oops reports containing sanity_check_pinned_pages
• Limit unprivileged use of GUP-related interfaces where feasible until patched