CVE-2024-35993 (GCVE-0-2024-35993)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:47 – Updated: 2026-08-05 11:31
VLAI
Title
mm: turn folio_test_hugetlb into a PageType
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: turn folio_test_hugetlb into a PageType The current folio_test_hugetlb() can be fooled by a concurrent folio split into returning true for a folio which has never belonged to hugetlbfs. This can't happen if the caller holds a refcount on it, but we have a few places (memory-failure, compaction, procfs) which do not and should not take a speculative reference. Since hugetlb pages do not use individual page mapcounts (they are always fully mapped and use the entire_mapcount field to record the number of mappings), the PageType field is available now that page_mapcount() ignores the value in this field. In compaction and with CONFIG_DEBUG_VM enabled, the current implementation can result in an oops, as reported by Luis. This happens since 9c5ccf2db04b ("mm: remove HUGETLB_PAGE_DTOR") effectively added some VM_BUG_ON() checks in the PageHuge() testing path. [willy@infradead.org: update vmcoreinfo]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 14:06 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a , < 2431b5f2650dfc47ce782d1ca7b02d6b3916976f (git)
Affected: 9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a , < 9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32 (git)
Affected: 9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a , < d99e3140a4d33e26066183ff727d8f02f56bec64 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.30 , ≤ 6.6.* (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:06:03.625705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:44.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.237Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/page-flags.h",
            "include/trace/events/mmflags.h",
            "kernel/vmcore_info.c",
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2431b5f2650dfc47ce782d1ca7b02d6b3916976f",
              "status": "affected",
              "version": "9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a",
              "versionType": "git"
            },
            {
              "lessThan": "9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32",
              "status": "affected",
              "version": "9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a",
              "versionType": "git"
            },
            {
              "lessThan": "d99e3140a4d33e26066183ff727d8f02f56bec64",
              "status": "affected",
              "version": "9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/page-flags.h",
            "include/trace/events/mmflags.h",
            "kernel/vmcore_info.c",
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: turn folio_test_hugetlb into a PageType\n\nThe current folio_test_hugetlb() can be fooled by a concurrent folio split\ninto returning true for a folio which has never belonged to hugetlbfs. \nThis can\u0027t happen if the caller holds a refcount on it, but we have a few\nplaces (memory-failure, compaction, procfs) which do not and should not\ntake a speculative reference.\n\nSince hugetlb pages do not use individual page mapcounts (they are always\nfully mapped and use the entire_mapcount field to record the number of\nmappings), the PageType field is available now that page_mapcount()\nignores the value in this field.\n\nIn compaction and with CONFIG_DEBUG_VM enabled, the current implementation\ncan result in an oops, as reported by Luis. This happens since 9c5ccf2db04b\n(\"mm: remove HUGETLB_PAGE_DTOR\") effectively added some VM_BUG_ON() checks\nin the PageHuge() testing path.\n\n[willy@infradead.org: update vmcoreinfo]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in core MM page-flag accessors reached via compaction, memory-failure and procfs; triggering it requires local execution to allocate/split THPs and drive compaction scans. There is no remote or adjacent-network path to this code.\nAC:L - This is a race the attacker creates on both sides \u2014 one set of threads forces THP splits via madvise(MADV_DONTNEED)/partial munmap while another drives compaction (memory pressure, THP faults, or CMA/dma-buf allocations), and compaction scans millions of PFNs per second, so the narrow window between the two loads is retried continuously at no cost.\nPR:L - Only an ordinary unprivileged local user is needed: THP allocation and splitting are unprivileged operations, and direct compaction plus alloc_contig_range (CMA/dma-buf heap, v4l2 videobuf2) are reachable from normal userspace on Android and embedded systems without any capability.\nUI:N - The attacker\u0027s own threads generate both the folio split and the compaction scan; no victim action or cooperation is required.\nS:U - The type confusion and resulting corruption stay within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - folio_test_hugetlb() misidentifies a THP as a hugetlb folio, causing the kernel to read and interpret THP tail-page fields (_flags_1/_flags_2, _hugetlb_subpool, _hugetlb_hwpoison) as hugetlb metadata; this type confusion and the resulting list/metadata corruption are leverageable for disclosure of kernel memory contents.\nI:H - Type confusion leads to hugetlb machinery mutating non-hugetlb state \u2014 isolate_hugetlb() performs list_move_tail() on a THP still on an LRU list and clears bits in folio-\u003eprivate, and folio_set_hugetlb_hwpoison() does llist_add() into fields overlapping a THP\u0027s _deferred_list, giving linked-list corruption and a write primitive.\nA:H - isolate_or_dissolve_huge_page() dereferences the NULL hstate returned by size_to_hstate() in hstate_is_gigantic() (h-\u003eorder), producing a kernel oops, and with CONFIG_DEBUG_VM_PGFLAGS the VM_BUG_ON_PGFLAGS in folio_flags() panics the kernel \u2014 the originally reported symptom."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:27.140Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32"
        },
        {
          "url": "https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64"
        }
      ],
      "title": "mm: turn folio_test_hugetlb into a PageType",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35993",
    "datePublished": "2024-05-20T09:47:57.739Z",
    "dateReserved": "2024-05-17T13:50:33.147Z",
    "dateUpdated": "2026-08-05T11:31:27.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35993",
      "date": "2026-08-12",
      "epss": "0.00215",
      "percentile": "0.1203"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: turn folio_test_hugetlb into a PageType\\n\\nThe current folio_test_hugetlb() can be fooled by a concurrent folio split\\ninto returning true for a folio which has never belonged to hugetlbfs. \\nThis can\u0027t happen if the caller holds a refcount on it, but we have a few\\nplaces (memory-failure, compaction, procfs) which do not and should not\\ntake a speculative reference.\\n\\nSince hugetlb pages do not use individual page mapcounts (they are always\\nfully mapped and use the entire_mapcount field to record the number of\\nmappings), the PageType field is available now that page_mapcount()\\nignores the value in this field.\\n\\nIn compaction and with CONFIG_DEBUG_VM enabled, the current implementation\\ncan result in an oops, as reported by Luis. This happens since 9c5ccf2db04b\\n(\\\"mm: remove HUGETLB_PAGE_DTOR\\\") effectively added some VM_BUG_ON() checks\\nin the PageHuge() testing path.\\n\\n[willy@infradead.org: update vmcoreinfo]\\n  Link: https://lkml.kernel.org/r/ZgGZUvsdhaT1Va-T@casper.infradead.org\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: convierte folio_test_hugetlb en un PageType. El folio_test_hugetlb() actual puede ser enga\\u00f1ado por una divisi\\u00f3n de folio concurrente y devuelve verdadero para un folio que nunca ha pertenecido a hugetlbfs. Esto no puede suceder si la persona que llama tiene un recuento sobre \\u00e9l, pero tenemos algunos lugares (fallo de memoria, compactaci\\u00f3n, procfs) que no toman ni deben tomar una referencia especulativa. Dado que las p\\u00e1ginas de Hugetlb no usan recuentos de mapas de p\\u00e1ginas individuales (siempre est\\u00e1n completamente asignadas y usan el campo Whole_mapcount para registrar el n\\u00famero de asignaciones), el campo PageType est\\u00e1 disponible ahora que page_mapcount() ignora el valor en este campo. En compactaci\\u00f3n y con CONFIG_DEBUG_VM habilitado, la implementaci\\u00f3n actual puede resultar en un error, seg\\u00fan lo informado por Luis. Esto sucede desde que 9c5ccf2db04b (\\\"mm: eliminar HUGETLB_PAGE_DTOR\\\") agreg\\u00f3 efectivamente algunas comprobaciones de VM_BUG_ON() en la ruta de prueba de PageHuge(). [willy@infradead.org: actualizar vmcoreinfo] Enlace: https://lkml.kernel.org/r/ZgGZUvsdhaT1Va-T@casper.infradead.org\"}]",
      "id": "CVE-2024-35993",
      "lastModified": "2024-11-21T09:21:23.090",
      "published": "2024-05-20T10:15:13.463",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35993\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:13.463\",\"lastModified\":\"2026-08-04T11:18:19.813\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: turn folio_test_hugetlb into a PageType\\n\\nThe current folio_test_hugetlb() can be fooled by a concurrent folio split\\ninto returning true for a folio which has never belonged to hugetlbfs. \\nThis can\u0027t happen if the caller holds a refcount on it, but we have a few\\nplaces (memory-failure, compaction, procfs) which do not and should not\\ntake a speculative reference.\\n\\nSince hugetlb pages do not use individual page mapcounts (they are always\\nfully mapped and use the entire_mapcount field to record the number of\\nmappings), the PageType field is available now that page_mapcount()\\nignores the value in this field.\\n\\nIn compaction and with CONFIG_DEBUG_VM enabled, the current implementation\\ncan result in an oops, as reported by Luis. This happens since 9c5ccf2db04b\\n(\\\"mm: remove HUGETLB_PAGE_DTOR\\\") effectively added some VM_BUG_ON() checks\\nin the PageHuge() testing path.\\n\\n[willy@infradead.org: update vmcoreinfo]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: convierte folio_test_hugetlb en un PageType. El folio_test_hugetlb() actual puede ser enga\u00f1ado por una divisi\u00f3n de folio concurrente y devuelve verdadero para un folio que nunca ha pertenecido a hugetlbfs. Esto no puede suceder si la persona que llama tiene un recuento sobre \u00e9l, pero tenemos algunos lugares (fallo de memoria, compactaci\u00f3n, procfs) que no toman ni deben tomar una referencia especulativa. Dado que las p\u00e1ginas de Hugetlb no usan recuentos de mapas de p\u00e1ginas individuales (siempre est\u00e1n completamente asignadas y usan el campo Whole_mapcount para registrar el n\u00famero de asignaciones), el campo PageType est\u00e1 disponible ahora que page_mapcount() ignora el valor en este campo. En compactaci\u00f3n y con CONFIG_DEBUG_VM habilitado, la implementaci\u00f3n actual puede resultar en un error, seg\u00fan lo informado por Luis. Esto sucede desde que 9c5ccf2db04b (\\\"mm: eliminar HUGETLB_PAGE_DTOR\\\") agreg\u00f3 efectivamente algunas comprobaciones de VM_BUG_ON() en la ruta de prueba de PageHuge(). [willy@infradead.org: actualizar vmcoreinfo] Enlace: https://lkml.kernel.org/r/ZgGZUvsdhaT1Va-T@casper.infradead.org\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/page-flags.h\",\"include/trace/events/mmflags.h\",\"kernel/vmcore_info.c\",\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a\",\"lessThan\":\"2431b5f2650dfc47ce782d1ca7b02d6b3916976f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a\",\"lessThan\":\"9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a\",\"lessThan\":\"d99e3140a4d33e26066183ff727d8f02f56bec64\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/page-flags.h\",\"include/trace/events/mmflags.h\",\"kernel/vmcore_info.c\",\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.30\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.9\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T14:06:03.625705Z\",\"id\":\"CVE-2024-35993\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.30\",\"matchCriteriaId\":\"B4D9BC34-65C4-4ACE-ABEF-1029C09F30B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.9\",\"matchCriteriaId\":\"5F9041E5-8358-4EF7-8F98-B812EDE49612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:52:17+00:00",
      "cve": "CVE-2024-35993",
      "id": "CVE-2024-35993",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: turn folio_test_hugetlb into a PageType",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35993.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T00:58:06Z",
      "cve": "CVE-2024-35993",
      "id": "CVE-2024-35993",
      "initial_release_date": "2024-05-21T01:58:24Z",
      "product_status:known_not_affected": "330",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35993",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35993.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:12.237Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35993\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T14:06:03.625705Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.749Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"mm: turn folio_test_hugetlb into a PageType\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is in core MM page-flag accessors reached via compaction, memory-failure and procfs; triggering it requires local execution to allocate/split THPs and drive compaction scans. There is no remote or adjacent-network path to this code.\\nAC:L - This is a race the attacker creates on both sides \\u2014 one set of threads forces THP splits via madvise(MADV_DONTNEED)/partial munmap while another drives compaction (memory pressure, THP faults, or CMA/dma-buf allocations), and compaction scans millions of PFNs per second, so the narrow window between the two loads is retried continuously at no cost.\\nPR:L - Only an ordinary unprivileged local user is needed: THP allocation and splitting are unprivileged operations, and direct compaction plus alloc_contig_range (CMA/dma-buf heap, v4l2 videobuf2) are reachable from normal userspace on Android and embedded systems without any capability.\\nUI:N - The attacker\u0027s own threads generate both the folio split and the compaction scan; no victim action or cooperation is required.\\nS:U - The type confusion and resulting corruption stay within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\\nC:H - folio_test_hugetlb() misidentifies a THP as a hugetlb folio, causing the kernel to read and interpret THP tail-page fields (_flags_1/_flags_2, _hugetlb_subpool, _hugetlb_hwpoison) as hugetlb metadata; this type confusion and the resulting list/metadata corruption are leverageable for disclosure of kernel memory contents.\\nI:H - Type confusion leads to hugetlb machinery mutating non-hugetlb state \\u2014 isolate_hugetlb() performs list_move_tail() on a THP still on an LRU list and clears bits in folio-\u003eprivate, and folio_set_hugetlb_hwpoison() does llist_add() into fields overlapping a THP\u0027s _deferred_list, giving linked-list corruption and a write primitive.\\nA:H - isolate_or_dissolve_huge_page() dereferences the NULL hstate returned by size_to_hstate() in hstate_is_gigantic() (h-\u003eorder), producing a kernel oops, and with CONFIG_DEBUG_VM_PGFLAGS the VM_BUG_ON_PGFLAGS in folio_flags() panics the kernel \\u2014 the originally reported symptom.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a\", \"lessThan\": \"2431b5f2650dfc47ce782d1ca7b02d6b3916976f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a\", \"lessThan\": \"9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9c5ccf2db04b8d7c3df363fdd4856c2b79ab2c6a\", \"lessThan\": \"d99e3140a4d33e26066183ff727d8f02f56bec64\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/page-flags.h\", \"include/trace/events/mmflags.h\", \"kernel/vmcore_info.c\", \"mm/hugetlb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.30\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/page-flags.h\", \"include/trace/events/mmflags.h\", \"kernel/vmcore_info.c\", \"mm/hugetlb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2431b5f2650dfc47ce782d1ca7b02d6b3916976f\"}, {\"url\": \"https://git.kernel.org/stable/c/9fdcc5b6359dfdaa52a55033bf50e2cedd66eb32\"}, {\"url\": \"https://git.kernel.org/stable/c/d99e3140a4d33e26066183ff727d8f02f56bec64\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: turn folio_test_hugetlb into a PageType\\n\\nThe current folio_test_hugetlb() can be fooled by a concurrent folio split\\ninto returning true for a folio which has never belonged to hugetlbfs. \\nThis can\u0027t happen if the caller holds a refcount on it, but we have a few\\nplaces (memory-failure, compaction, procfs) which do not and should not\\ntake a speculative reference.\\n\\nSince hugetlb pages do not use individual page mapcounts (they are always\\nfully mapped and use the entire_mapcount field to record the number of\\nmappings), the PageType field is available now that page_mapcount()\\nignores the value in this field.\\n\\nIn compaction and with CONFIG_DEBUG_VM enabled, the current implementation\\ncan result in an oops, as reported by Luis. This happens since 9c5ccf2db04b\\n(\\\"mm: remove HUGETLB_PAGE_DTOR\\\") effectively added some VM_BUG_ON() checks\\nin the PageHuge() testing path.\\n\\n[willy@infradead.org: update vmcoreinfo]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.30\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:27.140Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35993\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:27.140Z\", \"dateReserved\": \"2024-05-17T13:50:33.147Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:47:57.739Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.