← All advisories

Medium severity4.7NVD Advisory· Published Oct 21, 2024· Updated Jun 17, 2026

CVE-2024-49872

CVE-2024-49872

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/gup: fix memfd_pin_folios alloc race panic

If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here:

folio = memfd_alloc_folio(memfd, start_idx); if (IS_ERR(folio)) { ret = PTR_ERR(folio); if (ret != -EEXIST) goto err;

then on the next trip through the "while start_idx" loop we panic here:

if (folio) { folio_put(folio);

To fix, set the folio to NULL on error.

Affected products

14

Linux/Kernel3 versions
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.11,<6.11.3
- (no CPE)
- (no CPE)range: 6.11
osv-coords11 versions
pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:deb/ubuntu/[email protected]?arch=source&distro=oracular pkg:linux/kernel pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/kernel-source-longterm&distro=openSUSE%20Tumbleweed
< 6.11.0-1009.10+ 10 more
- (no CPE)range: < 6.11.0-1009.10
- (no CPE)range: < 6.11.0-1009.9
- (no CPE)range: < 6.11.0-1009.9
- (no CPE)range: < 6.11.0-1010.11
- (no CPE)range: < 6.11.0-1011.12
- (no CPE)range: < 6.11.0-1008.8
- (no CPE)range: < 6.11.0-1005.5
- (no CPE)range: < 6.11.0-18.18
- (no CPE)range: >= 6.11.0, < 6.11.3
- (no CPE)range: < 6.11.8-1.1
- (no CPE)range: < 6.12.11-1.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.