CVE-2024-39477: mm/hugetlb: do not call vma_add_reservation upon ENOMEM

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-05 · updated 2026-08-04
Weakness: CWE-770

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon ENOMEM sysbot reported a splat [1] on __unmap_hugepage_range(). This is because vma_needs_reservation() can return -ENOMEM if allocate_file_region_entries() fails to allocate the file_region struct for the reservation. Check for that and do not call vma_add_reservation() if that is the case, otherwise region_abort() and region_del() will see that we do not have any file_regions. If we detect that vma_needs_reservation() returned -ENOMEM, we clear the hugetlb_restore_reserve flag as if this reservation was still consumed, so free_huge_folio() will not increment the resv count. [1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa

Affected products

Linux kernel: from 6.9 before 6.9.5; 6.10.0-rc1, 6.10.0-rc2 — fixed in 6.9.5

How to fix

Upgrade to a fixed version: Linux kernel 6.9.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-39477 or the next vulnerability affects your stack