CVE-2024-42234

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix crashes from deferred split racing folio migration

Even on 6.10-rc6, I've been seeing elusive "Bad page state"s (often on

flags when freeing, yet the flags shown are not bad: PG_locked had been

set and cleared??), and VM_BUG_ON_PAGE(page_ref_count(page) == 0)s from

deferred_split_scan()'s folio_put(), and a variety of other BUG and WARN

symptoms implying double free by deferred split and large folio migration.

6.7 commit 9bcef5973e31 ("mm: memcg: fix split queue list crash when large

folio migration") was right to fix the memcg-dependent locking broken in

85ce2c517ade ("memcontrol: only transfer the memcg data for migration"),

but missed a subtlety of deferred_split_scan(): it moves folios to its own

local list to work on them without split_queue_lock, during which time

folio->_deferred_list is not empty, but even the "right" lock does nothing

to secure the folio and the list it is on.

Fortunately, deferred

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References