CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-20 · updated 2026-06-17
Weakness: CWE-617

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.

Affected products

Linux kernel: from 5.9.7 before 5.10; from 5.10.1 before 6.1.91; from 6.2 before 6.6.30; from 6.7 before 6.8.9; 5.10, 5.10-rc3, 5.10-rc4, 5.10-rc5, 5.10-rc6, 5.10-rc7 (+5) — fixed in 5.10, 6.1.91, 6.6.30, 6.8.9

How to fix

Upgrade to a fixed version: Linux kernel 5.10, 6.1.91, 6.6.30, 6.8.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-36000 or the next vulnerability affects your stack