CVE-2024-53079

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/thp: fix deferred split unqueue naming and locking

Recent changes are putting more pressure on THP deferred split queues:

under load revealing long-standing races, causing list_del corruptions,

"Bad page state"s and worse (I keep BUGs in both of those, so usually

don't get to see how badly they end up without). The relevant recent

changes being 6.8's mTHP, 6.10's mTHP swapout, and 6.12's mTHP swapin,

improved swap allocation, and underused THP splitting.

Before fixing locking: rename misleading folio_undo_large_rmappable(),

which does not undo large_rmappable, to folio_unqueue_deferred_split(),

which is what it does. But that and its out-of-line __callee are mm

internals of very limited usability: add comment and WARN_ON_ONCEs to

check usage; and return a bool to say if a deferred split was unqueued,

which can then be used in WARN_ON_ONCEs around safety checks (sparing

callers the arcane conditionals in __folio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References