Skip to content
Fencer Vulns
medium 5.5

CVE-2024-42243 json

mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray

published 2024-08-07 2 y ago modified 2026-10-30 9 d ago also EUVD-2024-39466

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray

Patch series "mm/filemap: Limit page cache size to that supported by xarray", v2.

Currently, xarray can't support arbitrary page cache size. More details can be found from the WARN_ON() statement in xas_split_alloc(). In our test whose code is attached below, we hit the WARN_ON() on ARM64 system where the base page size is 64KB and huge page size is 512MB. The issue was reported long time ago and some discussions on it can be found here [1].

[1] https://www.spinics.net/lists/linux-xfs/msg75404.html

In order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one supported by xarray and avoid PMD-sized page cache if needed. The code changes are suggested by David Hildenbrand.

PATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray PATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path PATCH[4] avoids PMD-sized page cache for shmem files if needed

Test program ============ # cat test.c #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <fcntl.h> #include <errno.h> #include <sys/syscall.h> #include <sys/mman.h>

#define TEST_XFS_FILENAME "/tmp/data" #define TEST_SHMEM_FILENAME "/dev/shm/data" #define TEST_MEM_SIZE 0x20000000

int main(int argc, char **argv) { const char *filename; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret;

if (pgsize != 0x10000) { fprintf(stderr, "64KB base page size is required\n"); return -EPERM; }

system("echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled"); system("rm -fr /tmp/data"); system("rm -fr /dev/shm/data"); system("echo 1 > /proc/sys/vm/drop_caches");

/* Open xfs or shmem file */ filename = TEST_XFS_FILENAME; if (argc > 1 && !strcmp(argv[1], "shmem")) filename = TEST_SHMEM_FILENAME;

fd = open(filename, O_CREAT | O_RDWR | O_TRUNC); if (fd < 0) { fprintf(stderr, "Unable to open <%s>\n", filename); return -EIO; }

/* Extend file size */ ret = ftruncate(fd, TEST_MEM_SIZE); if (ret) { fprintf(stderr, "Error %d to ftruncate()\n", ret); goto cleanup; }

/* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (buf == (void *)-1) { fprintf(stderr, "Unable to mmap <%s>\n", filename); goto cleanup; }

fprintf(stdout, "mapped buffer at 0x%p\n", buf); ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); if (ret) { fprintf(stderr, "Unable to madvise(MADV_HUGEPAGE)\n"); goto cleanup; }

/* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE); if (ret) { fprintf(stderr, "Error %d to madvise(MADV_POPULATE_WRITE)\n", ret); goto cleanup; }

/* Punch the file to enforce xarray split */ ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); if (ret) fprintf(stderr, "Error %d to fallocate()\n", ret);

cleanup: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd);

return 0; }

# gcc test.c -o test # cat /proc/1/smaps | grep KernelPageSize | head -n 1 KernelPageSize: 64 kB # ./test shmem : ------------[ cut here ]------------ WARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon \ drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 \ virtio_net sha1_ce net_failover failover virtio_console virtio_blk \ dimlib virtio_mmio CPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TC ---truncated---

Patch / fix

  • Linux Linux 6.1.191, 6.6.41, 6.9.10, 6.10
  • linux Debian 14, Debian 13 6.9.10-1

debian advisories DEBIAN-CVE-2024-42243

  • linux Ubuntu 24.04 LTS 6.8.0-48.48
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1018.20
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1017.19
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1013.17
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1015.15
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1017.20
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1002.4
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1014.16

ubuntu advisories UBUNTU-CVE-2024-42243

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9.4 EUS 5.14.0-427.47.1.el9_4
  • rv RHEL 9.4 EUS 5.14.0-427.47.1.el9_4
  • perf RHEL 9.4 EUS 5.14.0-427.47.1.el9_4
  • rtla RHEL 9.4 EUS 5.14.0-427.47.1.el9_4
  • bpftool RHEL 9.4 EUS 7.3.0-427.47.1.el9_4
  • libperf RHEL 9.4 EUS 5.14.0-427.47.1.el9_4
  • kernel-rt RHEL 9.4 EUS 5.14.0-427.47.1.el9_4
  • kernel-64k RHEL 9.4 EUS 5.14.0-427.47.1.el9_4

red hat advisories RHSA-2024:10771RHSA-2024:6745RHSA-2024:6744

  • kernel-rt Linux Micro 6.0 6.4.0-11.1
  • kernel-source-rt Linux Micro 6.0 6.4.0-11.1
  • kernel-livepatch-MICRO-6-0-RT_Update_3 Linux Micro 6.0 1-1.2
  • kernel-source Linux Micro 6.0 6.4.0-20.1
  • kernel-default Linux Micro 6.0 6.4.0-20.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-20.1
  • kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
  • kernel-livepatch-MICRO-6-0_Update_3 Linux Micro 6.0 1-1.2

suse advisories SUSE-SU-2025:20077-1SUSE-SU-2025:20073-1SUSE-SU-2024:3564-1SUSE-SU-2024:3561-1SUSE-SU-2024:3551-1

  • kernel Azure Linux 3.0 6.6.43.1-7

azure linux advisories AZL-47516

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-42243 updated cvss 5.5

kernel: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    affected: no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.2) kernel-debuginfo-common-s390x 5.14.0-284.84.1.el9_2, kernel-debuginfo-common-x86_64 5.14.0-284.84.1.el9_2, kernel-debuginfo-common-aarch64 5.14.0-284.84.1.el9_2, kernel-debuginfo-common-ppc64le 5.14.0-284.84.1.el9_2
    fixed: vendor fix RHSA-2024:6744
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.47.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.47.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.47.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.47.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.47.1.el9_4
    fixed: vendor fix RHSA-2024:10771
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) perf 5.14.0-284.84.1.el9_2, rtla 5.14.0-284.84.1.el9_2, kernel-devel-matched 5.14.0-284.84.1.el9_2, kernel-64k-devel-matched 5.14.0-284.84.1.el9_2, kernel-debug-devel-matched 5.14.0-284.84.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.84.1.el9_2, +5 more
    fixed: vendor fix RHSA-2024:6744
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.47.1.el9_4, perf 5.14.0-427.47.1.el9_4, rtla 5.14.0-427.47.1.el9_4, kernel-devel-matched 5.14.0-427.47.1.el9_4, kernel-64k-devel-matched 5.14.0-427.47.1.el9_4, kernel-debug-devel-matched 5.14.0-427.47.1.el9_4, +6 more
    fixed: vendor fix RHSA-2024:10771
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) bpftool 7.0.0-284.84.1.el9_2, kernel 5.14.0-284.84.1.el9_2, kernel-64k 5.14.0-284.84.1.el9_2, kernel-core 5.14.0-284.84.1.el9_2, kernel-tools 5.14.0-284.84.1.el9_2, python3-perf 5.14.0-284.84.1.el9_2, +28 more
    fixed: vendor fix RHSA-2024:6744
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.47.1.el9_4, kernel 5.14.0-427.47.1.el9_4, kernel-64k 5.14.0-427.47.1.el9_4, kernel-core 5.14.0-427.47.1.el9_4, kernel-tools 5.14.0-427.47.1.el9_4, python3-perf 5.14.0-427.47.1.el9_4, +28 more
    fixed: vendor fix RHSA-2024:10771
show 5 more
  • Red Hat Enterprise Linux Real Time EUS (v.9.2) kernel-rt 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-core 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-modules 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-debug-core 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-modules-core 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-debug-modules 5.14.0-284.84.1.rt14.369.el9_2, +4 more
    fixed: vendor fix RHSA-2024:6745
  • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.47.1.el9_4, kernel-rt-core 5.14.0-427.47.1.el9_4, kernel-rt-modules 5.14.0-427.47.1.el9_4, kernel-rt-debug-core 5.14.0-427.47.1.el9_4, kernel-rt-modules-core 5.14.0-427.47.1.el9_4, kernel-rt-debug-modules 5.14.0-427.47.1.el9_4, +4 more
    fixed: vendor fix RHSA-2024:10771
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2) kernel-rt 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-kvm 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-core 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-modules 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-debug-kvm 5.14.0-284.84.1.rt14.369.el9_2, kernel-rt-debug-core 5.14.0-284.84.1.rt14.369.el9_2, +6 more
    fixed: vendor fix RHSA-2024:6745
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.47.1.el9_4, kernel-rt-kvm 5.14.0-427.47.1.el9_4, kernel-rt-core 5.14.0-427.47.1.el9_4, kernel-rt-modules 5.14.0-427.47.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.47.1.el9_4, kernel-rt-debug-core 5.14.0-427.47.1.el9_4, +6 more
    fixed: vendor fix RHSA-2024:10771
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux AppStream EUS (v.9.2) kernel-doc 5.14.0-284.84.1.el9_2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.