CVE-2024-42316

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/mglru: fix div-by-zero in vmpressure_calc_level()

evict_folios() uses a second pass to reclaim folios that have gone through

page writeback and become clean before it finishes the first pass, since

folio_rotate_reclaimable() cannot handle those folios due to the

isolation.

The second pass tries to avoid potential double counting by deducting

scan_control->nr_scanned. However, this can result in underflow of

nr_scanned, under a condition where shrink_folio_list() does not increment

nr_scanned, i.e., when folio_trylock() fails.

The underflow can cause the divisor, i.e., scale=scanned+reclaimed in

vmpressure_calc_level(), to become zero, resulting in the following crash:

[exception RIP: vmpressure_work_fn+101]

process_one_work at ffffffffa3313f2b

Since scan_control->nr_scanned has no established semantics, the potential

double counting has minimal risks. Therefore, fix the problem by not

deducting scan_cont

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References