GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56628 (GCVE-0-2024-56628)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-08-05 11:45
VLAI
Title
LoongArch: Add architecture specific huge_pte_clear()
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add architecture specific huge_pte_clear() When executing mm selftests run_vmtests.sh, there is such an error: BUG: Bad page state in process uffd-unit-tests pfn:00000 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff) raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Modules linked in: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests Not tainted 6.12.0 #184 Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 Stack : 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000 900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8 900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 0000000000000001 0000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000 0000000000000022 0000000fffffffff fffffffffe000000 ffff800000000000 000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940 0000000000000000 0000000000000000 90000000025aa5e0 9000000002905000 0000000000000000 90000000028f8940 ffff800000000000 0000000000000000 0000000000000000 0000000000000000 9000000000223a94 000000012001839c 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d ... Call Trace: [<9000000000223a94>] show_stack+0x5c/0x180 [<9000000001c3fd64>] dump_stack_lvl+0x6c/0xa0 [<900000000056aa08>] bad_page+0x1a0/0x1f0 [<9000000000574978>] free_unref_folios+0xbf0/0xd20 [<90000000004e65cc>] folios_put_refs+0x1a4/0x2b8 [<9000000000599a0c>] free_pages_and_swap_cache+0x164/0x260 [<9000000000547698>] tlb_batch_pages_flush+0xa8/0x1c0 [<9000000000547f30>] tlb_finish_mmu+0xa8/0x218 [<9000000000543cb8>] exit_mmap+0x1a0/0x360 [<9000000000247658>] __mmput+0x78/0x200 [<900000000025583c>] do_exit+0x43c/0xde8 [<9000000000256490>] do_group_exit+0x68/0x110 [<9000000000256554>] sys_exit_group+0x1c/0x20 [<9000000001c413b4>] do_syscall+0x94/0x130 [<90000000002216d8>] handle_syscall+0xb8/0x158 Disabling lock debugging due to kernel taint BUG: non-zero pgtables_bytes on freeing mm: -16384 On LoongArch system, invalid huge pte entry should be invalid_pte_table or a single _PAGE_HUGE bit rather than a zero value. And it should be the same with invalid pmd entry, since pmd_none() is called by function free_pgd_range() and pmd_none() return 0 by huge_pte_clear(). So single _PAGE_HUGE bit is also treated as a valid pte table and free_pte_range() will be called in free_pmd_range(). free_pmd_range() pmd = pmd_offset(pud, addr); do { next = pmd_addr_end(addr, end); if (pmd_none_or_clear_bad(pmd)) continue; free_pte_range(tlb, pmd, addr); } while (pmd++, addr = next, addr != end); Here invalid_pte_table is used for both invalid huge pte entry and pmd entry.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 09cfefb7fa70c3af011b0db0a513fd80b2f18abc , < dba3c45e333a3a2a01395b5f5e5f88f8baba74e4 (git)
Affected: 09cfefb7fa70c3af011b0db0a513fd80b2f18abc , < 7dfbf011a57b9e1a40f5ce8080a53c497e105c6c (git)
Affected: 09cfefb7fa70c3af011b0db0a513fd80b2f18abc , < 9b602190cf2d8ac957be0011e418ed6c3b49b9a3 (git)
Affected: 09cfefb7fa70c3af011b0db0a513fd80b2f18abc , < 7cd1f5f77925ae905a57296932f0f9ef0dc364f8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:18.185Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/include/asm/hugetlb.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dba3c45e333a3a2a01395b5f5e5f88f8baba74e4",
              "status": "affected",
              "version": "09cfefb7fa70c3af011b0db0a513fd80b2f18abc",
              "versionType": "git"
            },
            {
              "lessThan": "7dfbf011a57b9e1a40f5ce8080a53c497e105c6c",
              "status": "affected",
              "version": "09cfefb7fa70c3af011b0db0a513fd80b2f18abc",
              "versionType": "git"
            },
            {
              "lessThan": "9b602190cf2d8ac957be0011e418ed6c3b49b9a3",
              "status": "affected",
              "version": "09cfefb7fa70c3af011b0db0a513fd80b2f18abc",
              "versionType": "git"
            },
            {
              "lessThan": "7cd1f5f77925ae905a57296932f0f9ef0dc364f8",
              "status": "affected",
              "version": "09cfefb7fa70c3af011b0db0a513fd80b2f18abc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/include/asm/hugetlb.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Add architecture specific huge_pte_clear()\n\nWhen executing mm selftests run_vmtests.sh, there is such an error:\n\n BUG: Bad page state in process uffd-unit-tests  pfn:00000\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0\n flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff)\n raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n Modules linked in: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat\n    virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse\n    nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs\n CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests Not tainted 6.12.0 #184\n Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\n Stack : 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000\n         900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8\n         900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 0000000000000001\n         0000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000\n         0000000000000022 0000000fffffffff fffffffffe000000 ffff800000000000\n         000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940\n         0000000000000000 0000000000000000 90000000025aa5e0 9000000002905000\n         0000000000000000 90000000028f8940 ffff800000000000 0000000000000000\n         0000000000000000 0000000000000000 9000000000223a94 000000012001839c\n         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d\n         ...\n Call Trace:\n [\u003c9000000000223a94\u003e] show_stack+0x5c/0x180\n [\u003c9000000001c3fd64\u003e] dump_stack_lvl+0x6c/0xa0\n [\u003c900000000056aa08\u003e] bad_page+0x1a0/0x1f0\n [\u003c9000000000574978\u003e] free_unref_folios+0xbf0/0xd20\n [\u003c90000000004e65cc\u003e] folios_put_refs+0x1a4/0x2b8\n [\u003c9000000000599a0c\u003e] free_pages_and_swap_cache+0x164/0x260\n [\u003c9000000000547698\u003e] tlb_batch_pages_flush+0xa8/0x1c0\n [\u003c9000000000547f30\u003e] tlb_finish_mmu+0xa8/0x218\n [\u003c9000000000543cb8\u003e] exit_mmap+0x1a0/0x360\n [\u003c9000000000247658\u003e] __mmput+0x78/0x200\n [\u003c900000000025583c\u003e] do_exit+0x43c/0xde8\n [\u003c9000000000256490\u003e] do_group_exit+0x68/0x110\n [\u003c9000000000256554\u003e] sys_exit_group+0x1c/0x20\n [\u003c9000000001c413b4\u003e] do_syscall+0x94/0x130\n [\u003c90000000002216d8\u003e] handle_syscall+0xb8/0x158\n Disabling lock debugging due to kernel taint\n BUG: non-zero pgtables_bytes on freeing mm: -16384\n\nOn LoongArch system, invalid huge pte entry should be invalid_pte_table\nor a single _PAGE_HUGE bit rather than a zero value. And it should be\nthe same with invalid pmd entry, since pmd_none() is called by function\nfree_pgd_range() and pmd_none() return 0 by huge_pte_clear(). So single\n_PAGE_HUGE bit is also treated as a valid pte table and free_pte_range()\nwill be called in free_pmd_range().\n\n  free_pmd_range()\n        pmd = pmd_offset(pud, addr);\n        do {\n                next = pmd_addr_end(addr, end);\n                if (pmd_none_or_clear_bad(pmd))\n                        continue;\n                free_pte_range(tlb, pmd, addr);\n        } while (pmd++, addr = next, addr != end);\n\nHere invalid_pte_table is used for both invalid huge pte entry and\npmd entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached purely through local syscalls on the attacker\u0027s own address space (`userfaultfd()`, `mmap(MAP_HUGETLB)`, `ioctl(UFFDIO_POISON)`, `munmap()`/exit). No network or remote peer input is involved.\nAC:L - The trigger is fully deterministic and entirely attacker-controlled \u2014 install a poison marker in a hugetlb VMA and unmap it; there is no race to win and no memory-layout precondition, and hugetlbfs/userfaultfd are standard on LoongArch defconfig.\nPR:L - Only an ordinary unprivileged local account is needed; `UFFD_USER_MODE_ONLY` makes `userfaultfd()` available regardless of the `vm.unprivileged_userfaultfd` sysctl, and mapping hugetlb pages requires no capability.\nUI:N - The attacking process performs every step itself; no victim action, mount, or file open is required.\nS:U - The corruption stays within the kernel\u0027s own memory-management authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A page the process never owned (PFN 0) is released into the buddy allocator, so it can be reallocated and read while still in use by the kernel or firmware, and the bogus `ptdesc-\u003eptl` free gives further slab-level corruption \u2014 both leveragable into arbitrary kernel memory disclosure.\nI:H - The same primitive hands the attacker a page that remains live elsewhere, plus an arbitrary `kmem_cache_free()` of a pointer read from a foreign struct page, yielding write access to memory in use by other contexts and page-table/allocator metadata corruption.\nA:H - The reported outcome is a `BUG: Bad page state` splat with kernel taint, page refcount underflow, and `BUG: non-zero pgtables_bytes on freeing mm` (a `VM_BUG_ON_MM` oops under `CONFIG_DEBUG_VM`), repeatable at will by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:33.447Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dba3c45e333a3a2a01395b5f5e5f88f8baba74e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dfbf011a57b9e1a40f5ce8080a53c497e105c6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b602190cf2d8ac957be0011e418ed6c3b49b9a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cd1f5f77925ae905a57296932f0f9ef0dc364f8"
        }
      ],
      "title": "LoongArch: Add architecture specific huge_pte_clear()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56628",
    "datePublished": "2024-12-27T14:51:30.583Z",
    "dateReserved": "2024-12-27T14:03:06.018Z",
    "dateUpdated": "2026-08-05T11:45:33.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56628",
      "date": "2026-09-12",
      "epss": "0.00215",
      "percentile": "0.1202"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nLoongArch: Add architecture specific huge_pte_clear()\\n\\nWhen executing mm selftests run_vmtests.sh, there is such an error:\\n\\n BUG: Bad page state in process uffd-unit-tests  pfn:00000\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0\\n flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff)\\n raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 0000000000000000\\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\\n Modules linked in: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat\\n    virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse\\n    nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs\\n CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests Not tainted 6.12.0 #184\\n Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\\n Stack : 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000\\n         900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8\\n         900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 0000000000000001\\n         0000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000\\n         0000000000000022 0000000fffffffff fffffffffe000000 ffff800000000000\\n         000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940\\n         0000000000000000 0000000000000000 90000000025aa5e0 9000000002905000\\n         0000000000000000 90000000028f8940 ffff800000000000 0000000000000000\\n         0000000000000000 0000000000000000 9000000000223a94 000000012001839c\\n         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d\\n         ...\\n Call Trace:\\n [\u003c9000000000223a94\u003e] show_stack+0x5c/0x180\\n [\u003c9000000001c3fd64\u003e] dump_stack_lvl+0x6c/0xa0\\n [\u003c900000000056aa08\u003e] bad_page+0x1a0/0x1f0\\n [\u003c9000000000574978\u003e] free_unref_folios+0xbf0/0xd20\\n [\u003c90000000004e65cc\u003e] folios_put_refs+0x1a4/0x2b8\\n [\u003c9000000000599a0c\u003e] free_pages_and_swap_cache+0x164/0x260\\n [\u003c9000000000547698\u003e] tlb_batch_pages_flush+0xa8/0x1c0\\n [\u003c9000000000547f30\u003e] tlb_finish_mmu+0xa8/0x218\\n [\u003c9000000000543cb8\u003e] exit_mmap+0x1a0/0x360\\n [\u003c9000000000247658\u003e] __mmput+0x78/0x200\\n [\u003c900000000025583c\u003e] do_exit+0x43c/0xde8\\n [\u003c9000000000256490\u003e] do_group_exit+0x68/0x110\\n [\u003c9000000000256554\u003e] sys_exit_group+0x1c/0x20\\n [\u003c9000000001c413b4\u003e] do_syscall+0x94/0x130\\n [\u003c90000000002216d8\u003e] handle_syscall+0xb8/0x158\\n Disabling lock debugging due to kernel taint\\n BUG: non-zero pgtables_bytes on freeing mm: -16384\\n\\nOn LoongArch system, invalid huge pte entry should be invalid_pte_table\\nor a single _PAGE_HUGE bit rather than a zero value. And it should be\\nthe same with invalid pmd entry, since pmd_none() is called by function\\nfree_pgd_range() and pmd_none() return 0 by huge_pte_clear(). So single\\n_PAGE_HUGE bit is also treated as a valid pte table and free_pte_range()\\nwill be called in free_pmd_range().\\n\\n  free_pmd_range()\\n        pmd = pmd_offset(pud, addr);\\n        do {\\n                next = pmd_addr_end(addr, end);\\n                if (pmd_none_or_clear_bad(pmd))\\n                        continue;\\n                free_pte_range(tlb, pmd, addr);\\n        } while (pmd++, addr = next, addr != end);\\n\\nHere invalid_pte_table is used for both invalid huge pte entry and\\npmd entry.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: Agregar huge_pte_clear() espec\\u00edfico de la arquitectura. Al ejecutar las pruebas autom\\u00e1ticas mm run_vmtests.sh, aparece el siguiente error: BUG: Bad page state in process uffd-unit-tests pfn:00000 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff) raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 p\\u00e1gina volcada porque: PAGE_FLAGS_CHECK_AT_FREE indicador(es) establecido(s) M\\u00f3dulos vinculados en: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests No contaminado 6.12.0 #184 Nombre del hardware: QEMU M\\u00e1quina virtual QEMU, BIOS desconocido 2/2/2022 Pila: 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000 900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8 900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 000000000000001 000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000 0000000000000022 0000000ffffffffff fffffffffe000000 ffff800000000000 000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940 0000000000000000 000000000000000 90000000025aa5e0 9000000002905000 0000000000000000 90000000028f8940 ffff800000000000 000000000000000 0000000000000000 0000000000000000 0000000000000000 9000000000223a94 000000012001839c 00000000000000b0 0000000000000004 000000000000000 0000000000071c1d ... Seguimiento de llamadas: [\u0026lt;9000000000223a94\u0026gt;] show_stack+0x5c/0x180 [\u0026lt;9000000001c3fd64\u0026gt;] dump_stack_lvl+0x6c/0xa0 [\u0026lt;900000000056aa08\u0026gt;] p\\u00e1gina_incorrecta+0x1a0/0x1f0 [\u0026lt;9000000000574978\u0026gt;] folios_sin_referencia_gratis+0xbf0/0xd20 [\u0026lt;90000000004e65cc\u0026gt;] folios_colocar_referencias+0x1a4/0x2b8 [\u0026lt;9000000000599a0c\u0026gt;] p\\u00e1ginas_y_cach\\u00e9_de_intercambio_gratis+0x164/0x260 [\u0026lt;9000000000547698\u0026gt;] vaciado_de_p\\u00e1ginas_por_lotes_tlb+0xa8/0x1c0 [\u0026lt;9000000000547f30\u0026gt;] tlb_finish_mmu+0xa8/0x218 [\u0026lt;9000000000543cb8\u0026gt;] salida_mmap+0x1a0/0x360 [\u0026lt;9000000000247658\u0026gt;] __mmput+0x78/0x200 [\u0026lt;900000000025583c\u0026gt;] hacer_salir+0x43c/0xde8 [\u0026lt;9000000000256490\u0026gt;] hacer_grupo_salir+0x68/0x110 [\u0026lt;9000000000256554\u0026gt;] grupo_salir_sistema+0x1c/0x20 [\u0026lt;9000000001c413b4\u0026gt;] hacer_llamada_sistema+0x94/0x130 [\u0026lt;90000000002216d8\u0026gt;] handle_syscall+0xb8/0x158 Deshabilitando la depuraci\\u00f3n de bloqueo debido a una contaminaci\\u00f3n del kernel ERROR: pgtables_bytes distintos de cero al liberar mm: -16384 En el sistema LoongArch, una entrada pte enorme no v\\u00e1lida debe ser invalid_pte_table o un solo bit _PAGE_HUGE en lugar de un valor cero. Y deber\\u00eda ser lo mismo con una entrada pmd no v\\u00e1lida, ya que pmd_none() es llamada por la funci\\u00f3n free_pgd_range() y pmd_none() devuelve 0 por huge_pte_clear(). Por lo tanto, un solo bit _PAGE_HUGE tambi\\u00e9n se trata como una tabla pte v\\u00e1lida y free_pte_range() se llamar\\u00e1 en free_pmd_range(). free_pmd_range() pmd = pmd_offset(pud, addr); do { next = pmd_addr_end(addr, end); if (pmd_none_or_clear_bad(pmd)) continue; free_pte_range(tlb, pmd, addr); } while (pmd++, addr = next, addr != end); Aqu\\u00ed invalid_pte_table se utiliza tanto para entradas pte enormes no v\\u00e1lidas como para entradas pmd.\"}]",
      "id": "CVE-2024-56628",
      "lastModified": "2024-12-27T15:15:22.357",
      "published": "2024-12-27T15:15:22.357",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/7cd1f5f77925ae905a57296932f0f9ef0dc364f8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7dfbf011a57b9e1a40f5ce8080a53c497e105c6c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9b602190cf2d8ac957be0011e418ed6c3b49b9a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dba3c45e333a3a2a01395b5f5e5f88f8baba74e4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56628\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:22.357\",\"lastModified\":\"2026-08-04T11:22:15.463\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nLoongArch: Add architecture specific huge_pte_clear()\\n\\nWhen executing mm selftests run_vmtests.sh, there is such an error:\\n\\n BUG: Bad page state in process uffd-unit-tests  pfn:00000\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0\\n flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff)\\n raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 0000000000000000\\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\\n Modules linked in: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat\\n    virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse\\n    nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs\\n CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests Not tainted 6.12.0 #184\\n Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\\n Stack : 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000\\n         900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8\\n         900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 0000000000000001\\n         0000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000\\n         0000000000000022 0000000fffffffff fffffffffe000000 ffff800000000000\\n         000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940\\n         0000000000000000 0000000000000000 90000000025aa5e0 9000000002905000\\n         0000000000000000 90000000028f8940 ffff800000000000 0000000000000000\\n         0000000000000000 0000000000000000 9000000000223a94 000000012001839c\\n         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d\\n         ...\\n Call Trace:\\n [\u003c9000000000223a94\u003e] show_stack+0x5c/0x180\\n [\u003c9000000001c3fd64\u003e] dump_stack_lvl+0x6c/0xa0\\n [\u003c900000000056aa08\u003e] bad_page+0x1a0/0x1f0\\n [\u003c9000000000574978\u003e] free_unref_folios+0xbf0/0xd20\\n [\u003c90000000004e65cc\u003e] folios_put_refs+0x1a4/0x2b8\\n [\u003c9000000000599a0c\u003e] free_pages_and_swap_cache+0x164/0x260\\n [\u003c9000000000547698\u003e] tlb_batch_pages_flush+0xa8/0x1c0\\n [\u003c9000000000547f30\u003e] tlb_finish_mmu+0xa8/0x218\\n [\u003c9000000000543cb8\u003e] exit_mmap+0x1a0/0x360\\n [\u003c9000000000247658\u003e] __mmput+0x78/0x200\\n [\u003c900000000025583c\u003e] do_exit+0x43c/0xde8\\n [\u003c9000000000256490\u003e] do_group_exit+0x68/0x110\\n [\u003c9000000000256554\u003e] sys_exit_group+0x1c/0x20\\n [\u003c9000000001c413b4\u003e] do_syscall+0x94/0x130\\n [\u003c90000000002216d8\u003e] handle_syscall+0xb8/0x158\\n Disabling lock debugging due to kernel taint\\n BUG: non-zero pgtables_bytes on freeing mm: -16384\\n\\nOn LoongArch system, invalid huge pte entry should be invalid_pte_table\\nor a single _PAGE_HUGE bit rather than a zero value. And it should be\\nthe same with invalid pmd entry, since pmd_none() is called by function\\nfree_pgd_range() and pmd_none() return 0 by huge_pte_clear(). So single\\n_PAGE_HUGE bit is also treated as a valid pte table and free_pte_range()\\nwill be called in free_pmd_range().\\n\\n  free_pmd_range()\\n        pmd = pmd_offset(pud, addr);\\n        do {\\n                next = pmd_addr_end(addr, end);\\n                if (pmd_none_or_clear_bad(pmd))\\n                        continue;\\n                free_pte_range(tlb, pmd, addr);\\n        } while (pmd++, addr = next, addr != end);\\n\\nHere invalid_pte_table is used for both invalid huge pte entry and\\npmd entry.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: Agregar huge_pte_clear() espec\u00edfico de la arquitectura. Al ejecutar las pruebas autom\u00e1ticas mm run_vmtests.sh, aparece el siguiente error: BUG: Bad page state in process uffd-unit-tests pfn:00000 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff) raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 p\u00e1gina volcada porque: PAGE_FLAGS_CHECK_AT_FREE indicador(es) establecido(s) M\u00f3dulos vinculados en: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests No contaminado 6.12.0 #184 Nombre del hardware: QEMU M\u00e1quina virtual QEMU, BIOS desconocido 2/2/2022 Pila: 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000 900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8 900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 000000000000001 000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000 0000000000000022 0000000ffffffffff fffffffffe000000 ffff800000000000 000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940 0000000000000000 000000000000000 90000000025aa5e0 9000000002905000 0000000000000000 90000000028f8940 ffff800000000000 000000000000000 0000000000000000 0000000000000000 0000000000000000 9000000000223a94 000000012001839c 00000000000000b0 0000000000000004 000000000000000 0000000000071c1d ... Seguimiento de llamadas: [\u0026lt;9000000000223a94\u0026gt;] show_stack+0x5c/0x180 [\u0026lt;9000000001c3fd64\u0026gt;] dump_stack_lvl+0x6c/0xa0 [\u0026lt;900000000056aa08\u0026gt;] p\u00e1gina_incorrecta+0x1a0/0x1f0 [\u0026lt;9000000000574978\u0026gt;] folios_sin_referencia_gratis+0xbf0/0xd20 [\u0026lt;90000000004e65cc\u0026gt;] folios_colocar_referencias+0x1a4/0x2b8 [\u0026lt;9000000000599a0c\u0026gt;] p\u00e1ginas_y_cach\u00e9_de_intercambio_gratis+0x164/0x260 [\u0026lt;9000000000547698\u0026gt;] vaciado_de_p\u00e1ginas_por_lotes_tlb+0xa8/0x1c0 [\u0026lt;9000000000547f30\u0026gt;] tlb_finish_mmu+0xa8/0x218 [\u0026lt;9000000000543cb8\u0026gt;] salida_mmap+0x1a0/0x360 [\u0026lt;9000000000247658\u0026gt;] __mmput+0x78/0x200 [\u0026lt;900000000025583c\u0026gt;] hacer_salir+0x43c/0xde8 [\u0026lt;9000000000256490\u0026gt;] hacer_grupo_salir+0x68/0x110 [\u0026lt;9000000000256554\u0026gt;] grupo_salir_sistema+0x1c/0x20 [\u0026lt;9000000001c413b4\u0026gt;] hacer_llamada_sistema+0x94/0x130 [\u0026lt;90000000002216d8\u0026gt;] handle_syscall+0xb8/0x158 Deshabilitando la depuraci\u00f3n de bloqueo debido a una contaminaci\u00f3n del kernel ERROR: pgtables_bytes distintos de cero al liberar mm: -16384 En el sistema LoongArch, una entrada pte enorme no v\u00e1lida debe ser invalid_pte_table o un solo bit _PAGE_HUGE en lugar de un valor cero. Y deber\u00eda ser lo mismo con una entrada pmd no v\u00e1lida, ya que pmd_none() es llamada por la funci\u00f3n free_pgd_range() y pmd_none() devuelve 0 por huge_pte_clear(). Por lo tanto, un solo bit _PAGE_HUGE tambi\u00e9n se trata como una tabla pte v\u00e1lida y free_pte_range() se llamar\u00e1 en free_pmd_range(). free_pmd_range() pmd = pmd_offset(pud, addr); do { next = pmd_addr_end(addr, end); if (pmd_none_or_clear_bad(pmd)) continue; free_pte_range(tlb, pmd, addr); } while (pmd++, addr = next, addr != end); Aqu\u00ed invalid_pte_table se utiliza tanto para entradas pte enormes no v\u00e1lidas como para entradas pmd.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/loongarch/include/asm/hugetlb.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"09cfefb7fa70c3af011b0db0a513fd80b2f18abc\",\"lessThan\":\"dba3c45e333a3a2a01395b5f5e5f88f8baba74e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09cfefb7fa70c3af011b0db0a513fd80b2f18abc\",\"lessThan\":\"7dfbf011a57b9e1a40f5ce8080a53c497e105c6c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09cfefb7fa70c3af011b0db0a513fd80b2f18abc\",\"lessThan\":\"9b602190cf2d8ac957be0011e418ed6c3b49b9a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09cfefb7fa70c3af011b0db0a513fd80b2f18abc\",\"lessThan\":\"7cd1f5f77925ae905a57296932f0f9ef0dc364f8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/loongarch/include/asm/hugetlb.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"96FDD29E-2D1D-4602-885E-33F1A42B1BB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7cd1f5f77925ae905a57296932f0f9ef0dc364f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7dfbf011a57b9e1a40f5ce8080a53c497e105c6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b602190cf2d8ac957be0011e418ed6c3b49b9a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dba3c45e333a3a2a01395b5f5e5f88f8baba74e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2025-11-25T08:41:11+00:00",
      "cve": "CVE-2024-56628",
      "id": "CVE-2024-56628",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: LoongArch: Add architecture specific huge_pte_clear()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56628.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:38:04Z",
      "cve": "CVE-2024-56628",
      "id": "CVE-2024-56628",
      "initial_release_date": "2025-01-10T00:21:56Z",
      "product_status:known_not_affected": "637",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56628",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56628.json",
      "version": "15"
    }
  }
}