What’s Vulnerable › Vulnerabilities

CVE-2024-26621: mm: huge_memory: don't force huge page alignment on 32 bit

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-02 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: don't force huge page alignment on 32 bit commit efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") caused two issues [1] [2] reported on 32 bit system or compat userspace. It doesn't make too much sense to force huge page alignment on 32 bit system due to the constrained virtual address space. [1] https://lore.kernel.org/linux-mm/d0a136a0-4a31-46bc-adf4-2db109a61672@kernel.org/ [2] https://lore.kernel.org/linux-mm/CAJuCfpHXLdQy1a2B6xN2d7quTYwg2OoZseYPZTRpU0eHHKD-sQ@mail.gmail.com/

Affected products

• Linux kernel: from 5.18 before 6.1.81; from 6.2 before 6.6.46; from 6.7 before 6.7.6; 6.8-rc1, 6.8-rc2 — fixed in 6.1.81, 6.6.46, 6.7.6

How to fix

Upgrade to a fixed version: Linux kernel 6.1.81, 6.6.46, 6.7.6. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/4ef9ad19e17676b9ef071309bc62020e2373705d
• https://git.kernel.org/stable/c/6ea9aa8d97e6563676094cb35755884173269555
• https://git.kernel.org/stable/c/7432376c913381c5f24d373a87ff629bbde94b47
• https://git.kernel.org/stable/c/87632bc9ecff5ded93433bc0fca428019bdd1cfe
• http://www.openwall.com/lists/oss-security/2024/07/08/3
• http://www.openwall.com/lists/oss-security/2024/07/08/4
• http://www.openwall.com/lists/oss-security/2024/07/08/5
• http://www.openwall.com/lists/oss-security/2024/07/08/6
• http://www.openwall.com/lists/oss-security/2024/07/08/7
• http://www.openwall.com/lists/oss-security/2024/07/08/8
• http://www.openwall.com/lists/oss-security/2024/07/09/1
• http://www.openwall.com/lists/oss-security/2024/07/10/5

Get alerted when CVE-2024-26621 or the next vulnerability affects your stack