CVE-2024-36000

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/[email protected]/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.

• linux linux kernel (>= 5.9.7 < 5.10) • linux linux kernel (>= 5.10.1 < 6.1.91) • linux linux kernel (>= 6.2 < 6.6.30) • linux linux kernel (>= 6.7 < 6.8.9) • linux linux kernel 5.10 • linux linux kernel 6.9