CVE-2024-41021: s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-29 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on s390. Therefore we do not expect to see VM_FAULT_HWPOISON in do_exception(). However, since commit af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more general"), it is possible to see VM_FAULT_HWPOISON in combination with PTE_MARKER_POISONED, even on architectures that do not support HWPOISON otherwise. In this case, we will end up on the BUG() in do_exception(). Fix this by treating VM_FAULT_HWPOISON the same as VM_FAULT_SIGBUS, similar to x86 when MEMORY_FAILURE is not configured. Also print unexpected fault flags, for easier debugging. Note that VM_FAULT_HWPOISON_LARGE is not expected, because s390 cannot support swap entries on other levels than PTE level.

Affected products

Linux kernel: from 6.6 before 6.6.44; from 6.7 before 6.9.12; from 6.10 before 6.10.2 — fixed in 6.10.2, 6.6.44, 6.9.12

How to fix

Upgrade to a fixed version: Linux kernel 6.10.2, 6.6.44, 6.9.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-41021 or the next vulnerability affects your stack