GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-39477 (GCVE-0-2024-39477)

Vulnerability from cvelistv5 – Published: 2024-07-05 06:55 – Updated: 2026-08-05 11:33
VLAI
Title
mm/hugetlb: do not call vma_add_reservation upon ENOMEM
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon ENOMEM sysbot reported a splat [1] on __unmap_hugepage_range(). This is because vma_needs_reservation() can return -ENOMEM if allocate_file_region_entries() fails to allocate the file_region struct for the reservation. Check for that and do not call vma_add_reservation() if that is the case, otherwise region_abort() and region_del() will see that we do not have any file_regions. If we detect that vma_needs_reservation() returned -ENOMEM, we clear the hugetlb_restore_reserve flag as if this reservation was still consumed, so free_huge_folio() will not increment the resv count. [1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:07 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: df7a6d1f64056aec572162c5d35ed9ff86ece6f3 , < aa998f9dcb34c28448f86e8f5490f20d5eb0eac7 (git)
Affected: df7a6d1f64056aec572162c5d35ed9ff86ece6f3 , < 8daf9c702ee7f825f0de8600abff764acfedea13 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.9.5 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:38.781989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:39.612Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa998f9dcb34c28448f86e8f5490f20d5eb0eac7",
              "status": "affected",
              "version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3",
              "versionType": "git"
            },
            {
              "lessThan": "8daf9c702ee7f825f0de8600abff764acfedea13",
              "status": "affected",
              "version": "df7a6d1f64056aec572162c5d35ed9ff86ece6f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: do not call vma_add_reservation upon ENOMEM\n\nsysbot reported a splat [1] on __unmap_hugepage_range().  This is because\nvma_needs_reservation() can return -ENOMEM if\nallocate_file_region_entries() fails to allocate the file_region struct\nfor the reservation.\n\nCheck for that and do not call vma_add_reservation() if that is the case,\notherwise region_abort() and region_del() will see that we do not have any\nfile_regions.\n\nIf we detect that vma_needs_reservation() returned -ENOMEM, we clear the\nhugetlb_restore_reserve flag as if this reservation was still consumed, so\nfree_huge_folio() will not increment the resv count.\n\n[1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through local syscalls on the attacker\u0027s own address space \u2014 mmap(MAP_HUGETLB), madvise(MADV_DONTNEED), munmap, or process exit driving __unmap_hugepage_range(). There is no network- or adjacent-reachable trigger.\nAC:L - Every element of the trigger is attacker-controlled and deterministic \u2014 the private anonymous hugetlb VMA, the merged reservation region, the drained region_cache, and the middle-page unmap that forces region_del()\u0027s split path; only the file_region kmalloc failure must be induced, which an attacker does by driving memory exhaustion (hugetlb hosts are already memory-tight, and a task that becomes an OOM victim has its GFP_KERNEL allocations fail while exit_mmap runs this exact code). Once the single ENOMEM lands, adds_in_progress stays at -1 permanently and the corruption repeats on ordinary faults without further allocation failures, so the attempt can be retried indefinitely.\nPR:L - A plain unprivileged local user suffices: hugetlb_file_setup() gates only SHM_HUGETLB on CAP_IPC_LOCK, so anonymous MAP_PRIVATE|MAP_HUGETLB mmap and MADV_DONTNEED on the resulting VMA require no capability. A non-zero hugepage pool is an administrator-side configuration, standard on database, KVM, DPDK and HPC hosts, not a privilege held by the attacker.\nUI:N - The attacker\u0027s own process performs the entire sequence \u2014 mmap, fault-in, madvise/munmap \u2014 with no action by any other user or victim process.\nS:U - The corruption is confined to kernel heap objects (struct resv_map and the slab freelist) within the same security authority; no VM, hypervisor, or IOMMU boundary is crossed.\nC:H - region_del() and get_file_region_entry_from_cache() fabricate a file_region pointing at the resv_map itself and then kfree() that interior pointer while the object is still live, producing overlapping slab objects and a freelist containing a misaligned pointer \u2014 a well-known route to reading adjacent kernel heap contents. The corrupted rw_semaphore also breaks the serialization of hugetlb page-table walks against unmapping, widening the disclosure surface.\nI:H - The bogus file_region overlays struct resv_map, so nrg-\u003efrom/nrg-\u003eto and copy_hugetlb_cgroup_uncharge_info() perform out-of-bounds writes over region_cache_count and the rw_semaphore (count, owner, wait_lock) that guards private hugetlb page tables, and kfree() of an interior pointer corrupts the SLUB freelist \u2014 a controllable heap-grooming primitive toward arbitrary write and control-flow hijack. The reservation accounting is also permanently falsified, letting one process steal huge pages reserved by another.\nA:H - On CONFIG_DEBUG_VM kernels this is an immediate panic via VM_BUG_ON(!resv-\u003eregion_cache_count) in region_abort() and VM_BUG_ON(adds_in_progress) in resv_map_release() \u2014 precisely the syzbot splat. Without DEBUG_VM the list poisoning, wrecked rw_semaphore (hangs/deadlock in hugetlb faults), slab corruption, and permanently inflated h-\u003eresv_huge_pages produce oopses and SIGBUS-level denial of hugepages for every user on the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:30.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13"
        }
      ],
      "title": "mm/hugetlb: do not call vma_add_reservation upon ENOMEM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39477",
    "datePublished": "2024-07-05T06:55:07.268Z",
    "dateReserved": "2024-06-25T14:23:23.746Z",
    "dateUpdated": "2026-08-05T11:33:30.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-39477",
      "date": "2026-09-16",
      "epss": "0.00189",
      "percentile": "0.0881"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.5\", \"matchCriteriaId\": \"54EDFD02-25E6-4BC8-9AD0-0A59881F400A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"C40DD2D9-90E3-4E95-9F1A-E7C680F11F2A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"54D5209E-E390-45C5-A5D1-C9EDB40819F7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb: do not call vma_add_reservation upon ENOMEM\\n\\nsysbot reported a splat [1] on __unmap_hugepage_range().  This is because\\nvma_needs_reservation() can return -ENOMEM if\\nallocate_file_region_entries() fails to allocate the file_region struct\\nfor the reservation.\\n\\nCheck for that and do not call vma_add_reservation() if that is the case,\\notherwise region_abort() and region_del() will see that we do not have any\\nfile_regions.\\n\\nIf we detect that vma_needs_reservation() returned -ENOMEM, we clear the\\nhugetlb_restore_reserve flag as if this reservation was still consumed, so\\nfree_huge_folio() will not increment the resv count.\\n\\n[1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: mm/hugetlb: no llame a vma_add_reservation cuando ENOMEM sysbot inform\\u00f3 un splat [1] en __unmap_hugepage_range(). Esto se debe a que vma_needs_reservation() puede devolver -ENOMEM si allocate_file_region_entries() no puede asignar la estructura file_region para la reserva. Verifique eso y no llame a vma_add_reservation() si ese es el caso; de lo contrario, region_abort() y region_del() ver\\u00e1n que no tenemos ning\\u00fan file_regions. Si detectamos que vma_needs_reservation() devolvi\\u00f3 -ENOMEM, borramos el indicador hugetlb_restore_reserve como si esta reserva todav\\u00eda estuviera consumida, por lo que free_huge_folio() no incrementar\\u00e1 el recuento de resv. [1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa\"}]",
      "id": "CVE-2024-39477",
      "lastModified": "2024-11-21T09:27:45.047",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-05T07:15:10.413",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39477\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-05T07:15:10.413\",\"lastModified\":\"2026-08-04T11:18:57.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb: do not call vma_add_reservation upon ENOMEM\\n\\nsysbot reported a splat [1] on __unmap_hugepage_range().  This is because\\nvma_needs_reservation() can return -ENOMEM if\\nallocate_file_region_entries() fails to allocate the file_region struct\\nfor the reservation.\\n\\nCheck for that and do not call vma_add_reservation() if that is the case,\\notherwise region_abort() and region_del() will see that we do not have any\\nfile_regions.\\n\\nIf we detect that vma_needs_reservation() returned -ENOMEM, we clear the\\nhugetlb_restore_reserve flag as if this reservation was still consumed, so\\nfree_huge_folio() will not increment the resv count.\\n\\n[1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mm/hugetlb: no llame a vma_add_reservation cuando ENOMEM sysbot inform\u00f3 un splat [1] en __unmap_hugepage_range(). Esto se debe a que vma_needs_reservation() puede devolver -ENOMEM si allocate_file_region_entries() no puede asignar la estructura file_region para la reserva. Verifique eso y no llame a vma_add_reservation() si ese es el caso; de lo contrario, region_abort() y region_del() ver\u00e1n que no tenemos ning\u00fan file_regions. Si detectamos que vma_needs_reservation() devolvi\u00f3 -ENOMEM, borramos el indicador hugetlb_restore_reserve como si esta reserva todav\u00eda estuviera consumida, por lo que free_huge_folio() no incrementar\u00e1 el recuento de resv. [1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"df7a6d1f64056aec572162c5d35ed9ff86ece6f3\",\"lessThan\":\"aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"df7a6d1f64056aec572162c5d35ed9ff86ece6f3\",\"lessThan\":\"8daf9c702ee7f825f0de8600abff764acfedea13\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.5\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:07:38.781989Z\",\"id\":\"CVE-2024-39477\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.5\",\"matchCriteriaId\":\"54EDFD02-25E6-4BC8-9AD0-0A59881F400A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C40DD2D9-90E3-4E95-9F1A-E7C680F11F2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"54D5209E-E390-45C5-A5D1-C9EDB40819F7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:44:21+00:00",
      "cve": "CVE-2024-39477",
      "id": "CVE-2024-39477",
      "initial_release_date": "2024-07-05T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/hugetlb: do not call vma_add_reservation upon ENOMEM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-39477.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:54:42Z",
      "cve": "CVE-2024-39477",
      "id": "CVE-2024-39477",
      "initial_release_date": "2024-07-06T02:58:36Z",
      "product_status:known_not_affected": "373",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-39477",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-39477.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:15.943Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39477\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:07:38.781989Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.040Z\"}}], \"cna\": {\"title\": \"mm/hugetlb: do not call vma_add_reservation upon ENOMEM\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"df7a6d1f64056aec572162c5d35ed9ff86ece6f3\", \"lessThan\": \"aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"df7a6d1f64056aec572162c5d35ed9ff86ece6f3\", \"lessThan\": \"8daf9c702ee7f825f0de8600abff764acfedea13\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/hugetlb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/hugetlb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aa998f9dcb34c28448f86e8f5490f20d5eb0eac7\"}, {\"url\": \"https://git.kernel.org/stable/c/8daf9c702ee7f825f0de8600abff764acfedea13\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb: do not call vma_add_reservation upon ENOMEM\\n\\nsysbot reported a splat [1] on __unmap_hugepage_range().  This is because\\nvma_needs_reservation() can return -ENOMEM if\\nallocate_file_region_entries() fails to allocate the file_region struct\\nfor the reservation.\\n\\nCheck for that and do not call vma_add_reservation() if that is the case,\\notherwise region_abort() and region_del() will see that we do not have any\\nfile_regions.\\n\\nIf we detect that vma_needs_reservation() returned -ENOMEM, we clear the\\nhugetlb_restore_reserve flag as if this reservation was still consumed, so\\nfree_huge_folio() will not increment the resv count.\\n\\n[1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.5\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:21:18.722Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39477\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:21:18.722Z\", \"dateReserved\": \"2024-06-25T14:23:23.746Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-05T06:55:07.268Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.