CVE-2024-57883
NoneCVSS
—
EPSS
0.2%
Published
Jan 15, 2025
CISA due date
—
Cloudanix analysis
A flaw in how the operating system tracks shared memory page tables can cause memory to be lost and the system to become unstable when certain memory-management tools run.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect refcount-based check in huge_pmd_unshare allows PMD page tables to be treated as shared when try_get_folio callers (split_huge_pages, damon, page_idle) inflate the count, causing the table to be leaked with nonzero mapcount and preventing unmapping of the backed HugeTLB page.
Why it matters to the business
Memory leaks and eventual system instability or crashes on Linux hosts that use huge pages, increasing operational overhead and risk of service disruption in environments relying on large-page workloads.
How an attack unfolds
An attacker or automated workload triggers refcount elevation on a PMD table via split_huge_pages or similar, then exercises huge_pmd_unshare; the flawed check treats the table as shared, leaks it, and leaves the HugeTLB page unmapped, leading to bad-page reports and resource exhaustion.
How to fix it
Update the Linux kernel to a version containing the independent pt_share_count field for PMD tables; apply the fix that reuses the pt_share_count field instead of the folio refcount for sharing decisions. No user-space changes required.
How to confirm the fix worked
Confirm the kernel build contains the pt_share_count changes in mm/hugetlb.c; run split_huge_pages workloads and verify absence of bad-page reports with nonzero mapcount on page tables; monitor /proc/meminfo HugePages for expected free counts.
Typical attack path
- Trigger refcount increase on a PMD table via split_huge_pages, damon, or page_idle
- Invoke path that calls huge_pmd_unshare
- Faulty shared-count check prevents table unmapping
- Page table is freed while still referenced, producing bad-page state and leaking the HugeTLB page
How to detect it
Inspect kernel logs for "BUG: Bad page state" with page_type f2(table) and nonzero mapcount; correlate with processes calling split_huge_pages_write or damon; watch for unexpected drops in available HugePages after such activity.
What your security team should do
- Prioritize kernel updates on systems using HugeTLB or transparent huge pages
- Test workloads that invoke split_huge_pages or DAMON before broad rollout
- Monitor kernel logs for bad_page and nonzero mapcount events until patched
The record
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page table shared count The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked: BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table. 1. The page table itself will be discarded after reporting the "nonzero mapcount". 2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.9-1 |
| Debian:14 | linux | 0 | 6.12.9-1 |
| Linux | Kernel | 2.6.20 | 5.10.239 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:20.04:LTS | linux | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-iot | 0 | No fix |
| Ubuntu:20.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.10 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.14 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.6 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi2 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | No fix |
| Ubuntu:22.04:LTS | linux | 0 | No fix |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-156.166 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1092.99 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | 6.8.0-1029.31~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1096.105 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | 6.8.0-1029.34~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1092.101 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | 6.8.0-1030.32~22.04.1 |
| Ubuntu:22.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1089.95 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1075.83 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | 6.8.0-60.63~22.04.1 |
| Ubuntu:22.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1086.89 |
| Ubuntu:22.04:LTS | linux-ibm-6.8 | 0 | 6.8.0-1026.26~22.04.1 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1087.93 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1088.93 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-156.166 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | 6.8.0-60.63.1~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | 5.15.0-1087.88 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | 6.8.0-1028.31~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 0 | 5.15.0-1045.45 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 0 | 5.15.0-1034.34 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle | 0 | 5.15.0-1090.96 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | 6.8.0-1026.27~22.04.1 |
| Ubuntu:22.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:22.04:LTS | linux-raspi | 0 | 5.15.0-1086.89 |
| Ubuntu:22.04:LTS | linux-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | 0 | 6.8.0-62.65~22.04.1 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | No fix |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | 5.15.0-1056.60 |
| Ubuntu:22.04:LTS:for:NVIDIA:BlueField | linux-bluefield | 0 | No fix |
| Ubuntu:22.04:LTS:for:NVIDIA:BlueField | linux-bluefield | 0 | 5.15.0-1076.78 |
| Ubuntu:24.04:LTS | linux | 0 | No fix |
| Ubuntu:24.04:LTS | linux | 0 | 6.8.0-60.63 |
| Ubuntu:24.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:24.04:LTS | linux-aws | 0 | 6.8.0-1029.31 |
| Ubuntu:24.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:24.04:LTS | linux-azure | 0 | 6.8.0-1029.34 |
| Ubuntu:24.04:LTS | linux-azure-6.11 | 0 | 6.11.0-1012.12~24.04.1 |
| Ubuntu:24.04:LTS | linux-azure-nvidia | 0 | 6.8.0-1016.17 |
| Ubuntu:24.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gcp | 0 | 6.8.0-1030.32 |
| Ubuntu:24.04:LTS | linux-gcp-6.11 | 0 | 6.11.0-1011.11~24.04.1 |
| Ubuntu:24.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gke | 0 | 6.8.0-1025.29 |
| Ubuntu:24.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gkeop | 0 | 6.8.0-1012.14 |
| Ubuntu:24.04:LTS | linux-hwe-6.11 | 0 | 6.11.0-21.21~24.04.1 |
| Ubuntu:24.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:24.04:LTS | linux-ibm | 0 | 6.8.0-1026.26 |
| Ubuntu:24.04:LTS | linux-intel | 0 | No fix |
| Ubuntu:24.04:LTS | linux-lowlatency | 0 | No fix |
| Ubuntu:24.04:LTS | linux-lowlatency | 0 | 6.8.0-60.63.1 |
| Ubuntu:24.04:LTS | linux-nvidia | 0 | No fix |
| Ubuntu:24.04:LTS | linux-nvidia | 0 | 6.8.0-1028.31 |
| Ubuntu:24.04:LTS | linux-nvidia-6.11 | 0 | 6.11.0-1007.7 |
| Ubuntu:24.04:LTS | linux-nvidia-lowlatency | 0 | No fix |
| Ubuntu:24.04:LTS | linux-nvidia-lowlatency | 0 | 6.8.0-1028.31.1 |
| Ubuntu:24.04:LTS | linux-nvidia-tegra | 0 | No fix |
| Ubuntu:24.04:LTS | linux-nvidia-tegra | 0 | 6.8.0-1008.8 |
| Ubuntu:24.04:LTS | linux-oem-6.11 | 0 | No fix |
| Ubuntu:24.04:LTS | linux-oem-6.11 | 0 | 6.11.0-1017.17 |
| Ubuntu:24.04:LTS | linux-oem-6.8 | 0 | No fix |
| Ubuntu:24.04:LTS | linux-oem-6.8 | 0 | 6.8.0-1028.28 |
| Ubuntu:24.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:24.04:LTS | linux-oracle | 0 | 6.8.0-1026.27 |
| Ubuntu:24.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:24.04:LTS | linux-raspi | 0 | 6.8.0-1028.32 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | 0 | No fix |
| Ubuntu:24.04:LTS | linux-realtime | 0 | No fix |
| Ubuntu:24.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:24.04:LTS | linux-riscv | 0 | 6.8.0-60.63.1 |
| Ubuntu:24.04:LTS | linux-xilinx | 0 | 6.8.0-1017.18 |
| Ubuntu:24.10 | linux | 0 | No fix |
| Ubuntu:24.10 | linux-aws | 0 | No fix |
| Ubuntu:24.10 | linux-azure | 0 | No fix |
| Ubuntu:24.10 | linux-gcp | 0 | No fix |
| Ubuntu:24.10 | linux-lowlatency | 0 | No fix |
Related vulnerabilities
- CVE-2025-38562 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects linux
- CVE-2025-22037 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-21760 In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU… Also affects linux
- CVE-2025-21758 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU… Also affects linux
- CVE-2025-21664 In the Linux kernel, the following vulnerability has been resolved: dm thin: make… Also affects linux
- CVE-2024-57946 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't… Also affects linux
- CVE-2024-57945 In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the… Also affects linux