GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-53109 (GCVE-0-2024-53109)

Vulnerability from cvelistv5 – Published: 2024-12-02 13:44 – Updated: 2026-08-05 11:43
VLAI
Title
nommu: pass NULL argument to vma_iter_prealloc()
Summary
In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vma_iter_prealloc() When deleting a vma entry from a maple tree, it has to pass NULL to vma_iter_prealloc() in order to calculate internal state of the tree, but it passed a wrong argument. As a result, nommu kernels crashed upon accessing a vma iterator, such as acct_collect() reading the size of vma entries after do_munmap(). This commit fixes this issue by passing a right argument to the preallocation call.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:10 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b5df09226450165c434084d346fcb6d4858b0d52 , < 8bbf0ab631cdf1dade6745f137cff98751e6ced7 (git)
Affected: b5df09226450165c434084d346fcb6d4858b0d52 , < aceaf33b7666b72dfb86e0aa977be81e3bcbc727 (git)
Affected: b5df09226450165c434084d346fcb6d4858b0d52 , < 247d720b2c5d22f7281437fd6054a138256986ba (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.63 , ≤ 6.6.* (semver)
Unaffected: 6.11.10 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53109",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:10:44.376950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:11.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/nommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bbf0ab631cdf1dade6745f137cff98751e6ced7",
              "status": "affected",
              "version": "b5df09226450165c434084d346fcb6d4858b0d52",
              "versionType": "git"
            },
            {
              "lessThan": "aceaf33b7666b72dfb86e0aa977be81e3bcbc727",
              "status": "affected",
              "version": "b5df09226450165c434084d346fcb6d4858b0d52",
              "versionType": "git"
            },
            {
              "lessThan": "247d720b2c5d22f7281437fd6054a138256986ba",
              "status": "affected",
              "version": "b5df09226450165c434084d346fcb6d4858b0d52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/nommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.10",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnommu: pass NULL argument to vma_iter_prealloc()\n\nWhen deleting a vma entry from a maple tree, it has to pass NULL to\nvma_iter_prealloc() in order to calculate internal state of the tree, but\nit passed a wrong argument.  As a result, nommu kernels crashed upon\naccessing a vma iterator, such as acct_collect() reading the size of vma\nentries after do_munmap().\n\nThis commit fixes this issue by passing a right argument to the\npreallocation call."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the munmap(2) syscall (vm_munmap \u2192 do_munmap \u2192 delete_vma_from_mm) and unconditionally via exit_mmap() on process exit, requiring local execution on the target. There is no network-facing path into mm/nommu.c.\nAC:L - On a NOMMU kernel the wrong store type is computed deterministically on every whole-VMA unmap, and because NOMMU VMAs are separated by NULL gap slots the invariant-breaking adjacent-NULL condition is produced essentially every time; the attacker fully controls VMA layout via mmap/munmap and needs no race or unpredictable memory state.\nPR:L - Any unprivileged local user can call mmap()/munmap() and exit a process; no capability, namespace, or filesystem permission is checked anywhere along the path.\nUI:N - The attacker triggers the corruption entirely within its own process by unmapping its own mappings, and the crash/OOB traversal occurs in that same process\u0027s context. No victim action is required.\nS:U - The corruption is confined to the kernel\u0027s own mm_struct maple tree and is exploited within the kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - mas_next_slot() walks past the end of the 256-byte maple node reading adjacent slab memory as slots/pivots, an unbounded out-of-bounds read whose values are returned as a VMA pointer and then dereferenced; leaked kernel heap contents surface to userspace through vma-iterator consumers such as acct_collect()\u0027s vsize accounting and /proc-based VMA reporting.\nI:H - The out-of-bounds-derived pointer is used as a struct vm_area_struct in exit_mmap()\u0027s delete_vma() path, giving an indirect call through vma-\u003evm_ops-\u003eclose, a refcount decrement via fput(vma-\u003evm_file), and a slab free via vm_area_free() on an attacker-influenced address \u2014 a control-flow hijack and arbitrary-free primitive, on top of the persistent maple-tree gap/metadata corruption.\nA:H - The commit explicitly documents that NOMMU kernels crash on any vma-iterator access after do_munmap(); the corruption is permanent for the mm and reliably reproducible, so an unprivileged process can panic the kernel at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:47.659Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bbf0ab631cdf1dade6745f137cff98751e6ced7"
        },
        {
          "url": "https://git.kernel.org/stable/c/aceaf33b7666b72dfb86e0aa977be81e3bcbc727"
        },
        {
          "url": "https://git.kernel.org/stable/c/247d720b2c5d22f7281437fd6054a138256986ba"
        }
      ],
      "title": "nommu: pass NULL argument to vma_iter_prealloc()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53109",
    "datePublished": "2024-12-02T13:44:41.622Z",
    "dateReserved": "2024-11-19T17:17:24.993Z",
    "dateUpdated": "2026-08-05T11:43:47.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53109",
      "date": "2026-09-16",
      "epss": "0.00244",
      "percentile": "0.1576"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6\", \"versionEndExcluding\": \"6.6.63\", \"matchCriteriaId\": \"BC10231A-96EA-466E-AB1B-9C40D6E030C0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.10\", \"matchCriteriaId\": \"C256F46A-AFDD-4B99-AA4F-67D9D9D2C55A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"24B88717-53F5-42AA-9B72-14C707639E3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"1EF8CD82-1EAE-4254-9545-F85AB94CF90F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnommu: pass NULL argument to vma_iter_prealloc()\\n\\nWhen deleting a vma entry from a maple tree, it has to pass NULL to\\nvma_iter_prealloc() in order to calculate internal state of the tree, but\\nit passed a wrong argument.  As a result, nommu kernels crashed upon\\naccessing a vma iterator, such as acct_collect() reading the size of vma\\nentries after do_munmap().\\n\\nThis commit fixes this issue by passing a right argument to the\\npreallocation call.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nommu: pasar argumento NULL a vma_iter_prealloc(). Al eliminar una entrada vma de un \\u00e1rbol maple, tiene que pasar NULL a vma_iter_prealloc() para calcular el estado interno del \\u00e1rbol, pero pas\\u00f3 un argumento incorrecto. Como resultado, los kernels nommu fallaban al acceder a un iterador vma, como acct_collect() que lee el tama\\u00f1o de las entradas vma despu\\u00e9s de do_munmap(). Esta confirmaci\\u00f3n corrige este problema al pasar un argumento correcto a la llamada de preasignaci\\u00f3n.\"}]",
      "id": "CVE-2024-53109",
      "lastModified": "2024-12-11T20:21:25.433",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-12-02T14:15:11.713",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/247d720b2c5d22f7281437fd6054a138256986ba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8bbf0ab631cdf1dade6745f137cff98751e6ced7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aceaf33b7666b72dfb86e0aa977be81e3bcbc727\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2025-01-29T00:00:00.000Z",
      "cve": "CVE-2024-53109",
      "id": "msrc_CVE-2024-53109",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nommu: pass NULL argument to vma_iter_prealloc()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53109.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53109\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-02T14:15:11.713\",\"lastModified\":\"2026-08-04T11:21:54.497\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnommu: pass NULL argument to vma_iter_prealloc()\\n\\nWhen deleting a vma entry from a maple tree, it has to pass NULL to\\nvma_iter_prealloc() in order to calculate internal state of the tree, but\\nit passed a wrong argument.  As a result, nommu kernels crashed upon\\naccessing a vma iterator, such as acct_collect() reading the size of vma\\nentries after do_munmap().\\n\\nThis commit fixes this issue by passing a right argument to the\\npreallocation call.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nommu: pasar argumento NULL a vma_iter_prealloc(). Al eliminar una entrada vma de un \u00e1rbol maple, tiene que pasar NULL a vma_iter_prealloc() para calcular el estado interno del \u00e1rbol, pero pas\u00f3 un argumento incorrecto. Como resultado, los kernels nommu fallaban al acceder a un iterador vma, como acct_collect() que lee el tama\u00f1o de las entradas vma despu\u00e9s de do_munmap(). Esta confirmaci\u00f3n corrige este problema al pasar un argumento correcto a la llamada de preasignaci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/nommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b5df09226450165c434084d346fcb6d4858b0d52\",\"lessThan\":\"8bbf0ab631cdf1dade6745f137cff98751e6ced7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b5df09226450165c434084d346fcb6d4858b0d52\",\"lessThan\":\"aceaf33b7666b72dfb86e0aa977be81e3bcbc727\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b5df09226450165c434084d346fcb6d4858b0d52\",\"lessThan\":\"247d720b2c5d22f7281437fd6054a138256986ba\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/nommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.63\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.10\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:10:44.376950Z\",\"id\":\"CVE-2024-53109\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.63\",\"matchCriteriaId\":\"BC10231A-96EA-466E-AB1B-9C40D6E030C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.10\",\"matchCriteriaId\":\"C256F46A-AFDD-4B99-AA4F-67D9D9D2C55A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EF8CD82-1EAE-4254-9545-F85AB94CF90F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/247d720b2c5d22f7281437fd6054a138256986ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8bbf0ab631cdf1dade6745f137cff98751e6ced7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aceaf33b7666b72dfb86e0aa977be81e3bcbc727\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:13:38+00:00",
      "cve": "CVE-2024-53109",
      "id": "CVE-2024-53109",
      "initial_release_date": "2024-12-02T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nommu: pass NULL argument to vma_iter_prealloc()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53109.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:19:45Z",
      "cve": "CVE-2024-53109",
      "id": "CVE-2024-53109",
      "initial_release_date": "2024-12-03T00:16:19Z",
      "product_status:known_not_affected": "547",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53109",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53109.json",
      "version": "24"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53109\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:10:44.376950Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:33:45.367Z\"}}], \"cna\": {\"title\": \"nommu: pass NULL argument to vma_iter_prealloc()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through the munmap(2) syscall (vm_munmap \\u2192 do_munmap \\u2192 delete_vma_from_mm) and unconditionally via exit_mmap() on process exit, requiring local execution on the target. There is no network-facing path into mm/nommu.c.\\nAC:L - On a NOMMU kernel the wrong store type is computed deterministically on every whole-VMA unmap, and because NOMMU VMAs are separated by NULL gap slots the invariant-breaking adjacent-NULL condition is produced essentially every time; the attacker fully controls VMA layout via mmap/munmap and needs no race or unpredictable memory state.\\nPR:L - Any unprivileged local user can call mmap()/munmap() and exit a process; no capability, namespace, or filesystem permission is checked anywhere along the path.\\nUI:N - The attacker triggers the corruption entirely within its own process by unmapping its own mappings, and the crash/OOB traversal occurs in that same process\u0027s context. No victim action is required.\\nS:U - The corruption is confined to the kernel\u0027s own mm_struct maple tree and is exploited within the kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - mas_next_slot() walks past the end of the 256-byte maple node reading adjacent slab memory as slots/pivots, an unbounded out-of-bounds read whose values are returned as a VMA pointer and then dereferenced; leaked kernel heap contents surface to userspace through vma-iterator consumers such as acct_collect()\u0027s vsize accounting and /proc-based VMA reporting.\\nI:H - The out-of-bounds-derived pointer is used as a struct vm_area_struct in exit_mmap()\u0027s delete_vma() path, giving an indirect call through vma-\u003evm_ops-\u003eclose, a refcount decrement via fput(vma-\u003evm_file), and a slab free via vm_area_free() on an attacker-influenced address \\u2014 a control-flow hijack and arbitrary-free primitive, on top of the persistent maple-tree gap/metadata corruption.\\nA:H - The commit explicitly documents that NOMMU kernels crash on any vma-iterator access after do_munmap(); the corruption is permanent for the mm and reliably reproducible, so an unprivileged process can panic the kernel at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b5df09226450165c434084d346fcb6d4858b0d52\", \"lessThan\": \"8bbf0ab631cdf1dade6745f137cff98751e6ced7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5df09226450165c434084d346fcb6d4858b0d52\", \"lessThan\": \"aceaf33b7666b72dfb86e0aa977be81e3bcbc727\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5df09226450165c434084d346fcb6d4858b0d52\", \"lessThan\": \"247d720b2c5d22f7281437fd6054a138256986ba\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/nommu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.63\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/nommu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8bbf0ab631cdf1dade6745f137cff98751e6ced7\"}, {\"url\": \"https://git.kernel.org/stable/c/aceaf33b7666b72dfb86e0aa977be81e3bcbc727\"}, {\"url\": \"https://git.kernel.org/stable/c/247d720b2c5d22f7281437fd6054a138256986ba\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnommu: pass NULL argument to vma_iter_prealloc()\\n\\nWhen deleting a vma entry from a maple tree, it has to pass NULL to\\nvma_iter_prealloc() in order to calculate internal state of the tree, but\\nit passed a wrong argument.  As a result, nommu kernels crashed upon\\naccessing a vma iterator, such as acct_collect() reading the size of vma\\nentries after do_munmap().\\n\\nThis commit fixes this issue by passing a right argument to the\\npreallocation call.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.63\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.10\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:43:47.659Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53109\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:43:47.659Z\", \"dateReserved\": \"2024-11-19T17:17:24.993Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-02T13:44:41.622Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.