Debian: CVE-2024-40948: linux, linux-6.1 -- security update

Debian: CVE-2024-40948: linux, linux-6.1 -- security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

07/12/2024

Created

07/19/2024

Added

07/18/2024

Modified

01/03/2025

Description

In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: fix crash on ZONE_DEVICE Not all pages may apply to pgtable check.One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around.One may reference devm_memremap_pages(). When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device: kernel BUG at mm/page_table_check.c:55! While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more.

Solution(s)

• debian-upgrade-linux
• debian-upgrade-linux-6-1

References

• https://attackerkb.com/topics/cve-2024-40948
• CVE - 2024-40948
• DSA-5731-1