GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-45022 (GCVE-0-2024-45022)

Vulnerability from cvelistv5 – Published: 2024-09-11 15:13 – Updated: 2026-08-05 11:37
VLAI
Title
mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 The __vmap_pages_range_noflush() assumes its argument pages** contains pages with the same page shift. However, since commit e9c3cda4d86e ("mm, vmalloc: fix high order __GFP_NOFAIL allocations"), if gfp_flags includes __GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation failed for high order, the pages** may contain two different page shifts (high order and order-0). This could lead __vmap_pages_range_noflush() to perform incorrect mappings, potentially resulting in memory corruption. Users might encounter this as follows (vmap_allow_huge = true, 2M is for PMD_SIZE): kvmalloc(2M, __GFP_NOFAIL|GFP_X) __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP) vm_area_alloc_pages(order=9) ---> order-9 allocation failed and fallback to order-0 vmap_pages_range() vmap_pages_range_noflush() __vmap_pages_range_noflush(page_shift = 21) ----> wrong mapping happens We can remove the fallback code because if a high-order allocation fails, __vmalloc_node_range_noprof() will retry with order-0. Therefore, it is unnecessary to fallback to order-0 here. Therefore, fix this by removing the fallback code.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 15:47 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fe5c2bdcb14c8612eb5e7a09159801c7219e9ac4 , < fd1ffbb50ef4da5e1378a46616b6d7407dc795da (git)
Affected: e9c3cda4d86e56bf7fe403729f38c4f0f65d3860 , < de7bad86345c43cd040ed43e20d9fad78a3ee59f (git)
Affected: e9c3cda4d86e56bf7fe403729f38c4f0f65d3860 , < c91618816f4d21fc574d7577a37722adcd4075b2 (git)
Affected: e9c3cda4d86e56bf7fe403729f38c4f0f65d3860 , < 61ebe5a747da649057c37be1c37eb934b4af79ca (git)
Affected: 6.1.95 , < 6.1.107 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.1.107 , ≤ 6.1.* (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45022",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:47:43.491220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:47:57.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:15:32.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd1ffbb50ef4da5e1378a46616b6d7407dc795da",
              "status": "affected",
              "version": "fe5c2bdcb14c8612eb5e7a09159801c7219e9ac4",
              "versionType": "git"
            },
            {
              "lessThan": "de7bad86345c43cd040ed43e20d9fad78a3ee59f",
              "status": "affected",
              "version": "e9c3cda4d86e56bf7fe403729f38c4f0f65d3860",
              "versionType": "git"
            },
            {
              "lessThan": "c91618816f4d21fc574d7577a37722adcd4075b2",
              "status": "affected",
              "version": "e9c3cda4d86e56bf7fe403729f38c4f0f65d3860",
              "versionType": "git"
            },
            {
              "lessThan": "61ebe5a747da649057c37be1c37eb934b4af79ca",
              "status": "affected",
              "version": "e9c3cda4d86e56bf7fe403729f38c4f0f65d3860",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.107",
              "status": "affected",
              "version": "6.1.95",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "6.1.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0\n\nThe __vmap_pages_range_noflush() assumes its argument pages** contains\npages with the same page shift.  However, since commit e9c3cda4d86e (\"mm,\nvmalloc: fix high order __GFP_NOFAIL allocations\"), if gfp_flags includes\n__GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation\nfailed for high order, the pages** may contain two different page shifts\n(high order and order-0).  This could lead __vmap_pages_range_noflush() to\nperform incorrect mappings, potentially resulting in memory corruption.\n\nUsers might encounter this as follows (vmap_allow_huge = true, 2M is for\nPMD_SIZE):\n\nkvmalloc(2M, __GFP_NOFAIL|GFP_X)\n    __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)\n        vm_area_alloc_pages(order=9) ---\u003e order-9 allocation failed and fallback to order-0\n            vmap_pages_range()\n                vmap_pages_range_noflush()\n                    __vmap_pages_range_noflush(page_shift = 21) ----\u003e wrong mapping happens\n\nWe can remove the fallback code because if a high-order allocation fails,\n__vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is\nunnecessary to fallback to order-0 here.  Therefore, fix this by removing\nthe fallback code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the core vmalloc allocator and is reached through ordinary local allocation activity (syscalls, filesystem and driver paths that use kvmalloc/vmalloc_huge with __GFP_NOFAIL); no remote protocol handler drives a \u2265PMD_SIZE __GFP_NOFAIL vmalloc, so it requires local access.\nAC:L - The only precondition is that the order-9 allocation fails, which an unprivileged process can reliably induce by creating memory pressure and fragmentation; once any high-order attempt fails, the order-0 fallback is taken and the wrong-shift mapping is produced deterministically with no race to win.\nPR:L - A basic unprivileged local user can both drive memory fragmentation and trigger the large __GFP_NOFAIL kvmalloc paths through normal filesystem/driver operations; no capability or namespace privilege is checked anywhere along the path from kvmalloc() into vm_area_alloc_pages().\nUI:N - Triggering only requires the attacker\u0027s own allocation and memory-pressure activity; no victim action, mount, or file open by another user is needed.\nS:U - The mis-mapping corrupts kernel memory within the same kernel security authority; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The returned buffer aliases up to 2 MiB of physical memory per PMD that was never allocated to it, so reading it discloses arbitrary adjacent kernel and user data (slab objects, page tables, page cache, other tasks\u0027 pages).\nI:H - The same alias window is mapped PAGE_KERNEL read-write, so writes through the vmalloc pointer corrupt unrelated physical frames \u2014 an arbitrary-write primitive over neighbouring memory that can be steered at creds, page tables, or function pointers for privilege escalation.\nA:H - Overwriting foreign physical frames (page tables, slab metadata) or mapping non-RAM pfns readily produces oopses, machine checks, and kernel panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:47.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da"
        },
        {
          "url": "https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca"
        }
      ],
      "title": "mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45022",
    "datePublished": "2024-09-11T15:13:55.837Z",
    "dateReserved": "2024-08-21T05:34:56.684Z",
    "dateUpdated": "2026-08-05T11:37:47.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45022",
      "date": "2026-09-16",
      "epss": "0.00229",
      "percentile": "0.1387"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1.95\", \"versionEndExcluding\": \"6.1.107\", \"matchCriteriaId\": \"EAB88E73-4A4D-4E7B-B85E-47EA47174A83\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.6.48\", \"matchCriteriaId\": \"8A7B36D8-72F7-4F2A-A151-A59474D95B61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0\\n\\nThe __vmap_pages_range_noflush() assumes its argument pages** contains\\npages with the same page shift.  However, since commit e9c3cda4d86e (\\\"mm,\\nvmalloc: fix high order __GFP_NOFAIL allocations\\\"), if gfp_flags includes\\n__GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation\\nfailed for high order, the pages** may contain two different page shifts\\n(high order and order-0).  This could lead __vmap_pages_range_noflush() to\\nperform incorrect mappings, potentially resulting in memory corruption.\\n\\nUsers might encounter this as follows (vmap_allow_huge = true, 2M is for\\nPMD_SIZE):\\n\\nkvmalloc(2M, __GFP_NOFAIL|GFP_X)\\n    __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)\\n        vm_area_alloc_pages(order=9) ---\u003e order-9 allocation failed and fallback to order-0\\n            vmap_pages_range()\\n                vmap_pages_range_noflush()\\n                    __vmap_pages_range_noflush(page_shift = 21) ----\u003e wrong mapping happens\\n\\nWe can remove the fallback code because if a high-order allocation fails,\\n__vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is\\nunnecessary to fallback to order-0 here.  Therefore, fix this by removing\\nthe fallback code.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/vmalloc: se corrige la asignaci\\u00f3n de p\\u00e1ginas si vm_area_alloc_pages() con un retroceso de orden superior al orden 0 __vmap_pages_range_noflush() asume que su argumento pages** contiene p\\u00e1ginas con el mismo cambio de p\\u00e1gina. Sin embargo, desde el commit e9c3cda4d86e (\\\"mm, vmalloc: se corrigen las asignaciones de orden superior __GFP_NOFAIL\\\"), si gfp_flags incluye __GFP_NOFAIL con orden superior en vm_area_alloc_pages() y la asignaci\\u00f3n de p\\u00e1ginas falla para el orden superior, pages** puede contener dos cambios de p\\u00e1gina diferentes (orden superior y orden 0). Esto podr\\u00eda provocar que __vmap_pages_range_noflush() realice asignaciones incorrectas, lo que podr\\u00eda provocar una corrupci\\u00f3n de memoria. Los usuarios pueden encontrarse con esto de la siguiente manera (vmap_allow_huge = true, 2M es para PMD_SIZE): kvmalloc(2M, __GFP_NOFAIL|GFP_X) __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP) vm_area_alloc_pages(order=9) ---\u0026gt; la asignaci\\u00f3n del pedido 9 fall\\u00f3 y se vuelve al pedido 0 vmap_pages_range() vmap_pages_range_noflush() __vmap_pages_range_noflush(page_shift = 21) ----\u0026gt; ocurre una asignaci\\u00f3n incorrecta Podemos eliminar el c\\u00f3digo de respaldo porque si falla una asignaci\\u00f3n de orden alto, __vmalloc_node_range_noprof() volver\\u00e1 a intentarlo con el pedido 0. Por lo tanto, no es necesario volver al pedido 0 aqu\\u00ed. Por lo tanto, solucione esto eliminando el c\\u00f3digo de respaldo.\"}]",
      "id": "CVE-2024-45022",
      "lastModified": "2024-09-13T16:36:39.043",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-11T16:15:07.163",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:02:01.000Z",
      "cve": "CVE-2024-45022",
      "id": "msrc_CVE-2024-45022",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45022.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45022\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-11T16:15:07.163\",\"lastModified\":\"2026-08-04T11:20:12.083\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0\\n\\nThe __vmap_pages_range_noflush() assumes its argument pages** contains\\npages with the same page shift.  However, since commit e9c3cda4d86e (\\\"mm,\\nvmalloc: fix high order __GFP_NOFAIL allocations\\\"), if gfp_flags includes\\n__GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation\\nfailed for high order, the pages** may contain two different page shifts\\n(high order and order-0).  This could lead __vmap_pages_range_noflush() to\\nperform incorrect mappings, potentially resulting in memory corruption.\\n\\nUsers might encounter this as follows (vmap_allow_huge = true, 2M is for\\nPMD_SIZE):\\n\\nkvmalloc(2M, __GFP_NOFAIL|GFP_X)\\n    __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)\\n        vm_area_alloc_pages(order=9) ---\u003e order-9 allocation failed and fallback to order-0\\n            vmap_pages_range()\\n                vmap_pages_range_noflush()\\n                    __vmap_pages_range_noflush(page_shift = 21) ----\u003e wrong mapping happens\\n\\nWe can remove the fallback code because if a high-order allocation fails,\\n__vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is\\nunnecessary to fallback to order-0 here.  Therefore, fix this by removing\\nthe fallback code.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/vmalloc: se corrige la asignaci\u00f3n de p\u00e1ginas si vm_area_alloc_pages() con un retroceso de orden superior al orden 0 __vmap_pages_range_noflush() asume que su argumento pages** contiene p\u00e1ginas con el mismo cambio de p\u00e1gina. Sin embargo, desde el commit e9c3cda4d86e (\\\"mm, vmalloc: se corrigen las asignaciones de orden superior __GFP_NOFAIL\\\"), si gfp_flags incluye __GFP_NOFAIL con orden superior en vm_area_alloc_pages() y la asignaci\u00f3n de p\u00e1ginas falla para el orden superior, pages** puede contener dos cambios de p\u00e1gina diferentes (orden superior y orden 0). Esto podr\u00eda provocar que __vmap_pages_range_noflush() realice asignaciones incorrectas, lo que podr\u00eda provocar una corrupci\u00f3n de memoria. Los usuarios pueden encontrarse con esto de la siguiente manera (vmap_allow_huge = true, 2M es para PMD_SIZE): kvmalloc(2M, __GFP_NOFAIL|GFP_X) __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP) vm_area_alloc_pages(order=9) ---\u0026gt; la asignaci\u00f3n del pedido 9 fall\u00f3 y se vuelve al pedido 0 vmap_pages_range() vmap_pages_range_noflush() __vmap_pages_range_noflush(page_shift = 21) ----\u0026gt; ocurre una asignaci\u00f3n incorrecta Podemos eliminar el c\u00f3digo de respaldo porque si falla una asignaci\u00f3n de orden alto, __vmalloc_node_range_noprof() volver\u00e1 a intentarlo con el pedido 0. Por lo tanto, no es necesario volver al pedido 0 aqu\u00ed. Por lo tanto, solucione esto eliminando el c\u00f3digo de respaldo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/vmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe5c2bdcb14c8612eb5e7a09159801c7219e9ac4\",\"lessThan\":\"fd1ffbb50ef4da5e1378a46616b6d7407dc795da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860\",\"lessThan\":\"de7bad86345c43cd040ed43e20d9fad78a3ee59f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860\",\"lessThan\":\"c91618816f4d21fc574d7577a37722adcd4075b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860\",\"lessThan\":\"61ebe5a747da649057c37be1c37eb934b4af79ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.95\",\"lessThan\":\"6.1.107\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/vmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.107\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.48\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.7\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T15:47:43.491220Z\",\"id\":\"CVE-2024-45022\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.95\",\"versionEndExcluding\":\"6.1.107\",\"matchCriteriaId\":\"EAB88E73-4A4D-4E7B-B85E-47EA47174A83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.48\",\"matchCriteriaId\":\"8A7B36D8-72F7-4F2A-A151-A59474D95B61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:13:20+00:00",
      "cve": "CVE-2024-45022",
      "id": "CVE-2024-45022",
      "initial_release_date": "2024-09-11T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45022.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:58:57Z",
      "cve": "CVE-2024-45022",
      "id": "CVE-2024-45022",
      "initial_release_date": "2024-09-12T02:51:18Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "432",
      "product_status:recommended": "395",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-45022",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-45022.json",
      "version": "75"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:15:32.309Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45022\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:47:43.491220Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:47:47.609Z\"}}], \"cna\": {\"title\": \"mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fe5c2bdcb14c8612eb5e7a09159801c7219e9ac4\", \"lessThan\": \"fd1ffbb50ef4da5e1378a46616b6d7407dc795da\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860\", \"lessThan\": \"de7bad86345c43cd040ed43e20d9fad78a3ee59f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860\", \"lessThan\": \"c91618816f4d21fc574d7577a37722adcd4075b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860\", \"lessThan\": \"61ebe5a747da649057c37be1c37eb934b4af79ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.1.95\", \"lessThan\": \"6.1.107\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/vmalloc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.107\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/vmalloc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da\"}, {\"url\": \"https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f\"}, {\"url\": \"https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2\"}, {\"url\": \"https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0\\n\\nThe __vmap_pages_range_noflush() assumes its argument pages** contains\\npages with the same page shift.  However, since commit e9c3cda4d86e (\\\"mm,\\nvmalloc: fix high order __GFP_NOFAIL allocations\\\"), if gfp_flags includes\\n__GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation\\nfailed for high order, the pages** may contain two different page shifts\\n(high order and order-0).  This could lead __vmap_pages_range_noflush() to\\nperform incorrect mappings, potentially resulting in memory corruption.\\n\\nUsers might encounter this as follows (vmap_allow_huge = true, 2M is for\\nPMD_SIZE):\\n\\nkvmalloc(2M, __GFP_NOFAIL|GFP_X)\\n    __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)\\n        vm_area_alloc_pages(order=9) ---\u003e order-9 allocation failed and fallback to order-0\\n            vmap_pages_range()\\n                vmap_pages_range_noflush()\\n                    __vmap_pages_range_noflush(page_shift = 21) ----\u003e wrong mapping happens\\n\\nWe can remove the fallback code because if a high-order allocation fails,\\n__vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is\\nunnecessary to fallback to order-0 here.  Therefore, fix this by removing\\nthe fallback code.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.107\", \"versionStartIncluding\": \"6.1.95\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.48\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:21.808Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45022\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:21.808Z\", \"dateReserved\": \"2024-08-21T05:34:56.684Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-11T15:13:55.837Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.