GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-39474 (GCVE-0-2024-39474)

Vulnerability from cvelistv5 – Published: 2024-07-05 06:55 – Updated: 2026-05-11 20:21
VLAI
Title
mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possible scenario is as follows: process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --> oom-killer send SIGKILL to process-a if (fatal_signal_pending(current)) break; --> return NULL; To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set. This issue occurred during OPLUS KASAN TEST. Below is part of the log -> oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.259756] [T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] die_kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abort+0x3c/0x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --> be->decompressed_pages = kvcalloc(be->nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); kernel panic by NULL pointer dereference. erofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-08 17:54 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9376130c390a76fac2788a5d6e1a149017b4ab50 , < 198a80833e3421d4c9820a4ae907120adf598c91 (git)
Affected: 9376130c390a76fac2788a5d6e1a149017b4ab50 , < c55d3564ad25ce87ab7cc6af251f9574faebd8da (git)
Affected: 9376130c390a76fac2788a5d6e1a149017b4ab50 , < 758678b65164b2158fc1de411092191cb3c394d4 (git)
Affected: 9376130c390a76fac2788a5d6e1a149017b4ab50 , < 8e0545c83d672750632f46e3f9ad95c48c91a0fc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.95 , ≤ 6.1.* (semver)
Unaffected: 6.6.34 , ≤ 6.6.* (semver)
Unaffected: 6.9.5 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-08T17:54:33.929150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T17:54:45.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:56:06.743Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "198a80833e3421d4c9820a4ae907120adf598c91",
              "status": "affected",
              "version": "9376130c390a76fac2788a5d6e1a149017b4ab50",
              "versionType": "git"
            },
            {
              "lessThan": "c55d3564ad25ce87ab7cc6af251f9574faebd8da",
              "status": "affected",
              "version": "9376130c390a76fac2788a5d6e1a149017b4ab50",
              "versionType": "git"
            },
            {
              "lessThan": "758678b65164b2158fc1de411092191cb3c394d4",
              "status": "affected",
              "version": "9376130c390a76fac2788a5d6e1a149017b4ab50",
              "versionType": "git"
            },
            {
              "lessThan": "8e0545c83d672750632f46e3f9ad95c48c91a0fc",
              "status": "affected",
              "version": "9376130c390a76fac2788a5d6e1a149017b4ab50",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.34",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\n\ncommit a421ef303008 (\"mm: allow !GFP_KERNEL allocations for kvmalloc\")\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\ndd544141b9eb (\"vmalloc: back off when the current task is OOM-killed\").  A\npossible scenario is as follows:\n\nprocess-a\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\n    __vmalloc_area_node()\n        vm_area_alloc_pages()\n\t\t--\u003e oom-killer send SIGKILL to process-a\n        if (fatal_signal_pending(current)) break;\n--\u003e return NULL;\n\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\nif __GFP_NOFAIL set.\n\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\n-\u003e oom-killer sends signal to process\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\n\n[65731.259685] [T32454] Call trace:\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\n[65731.259734] [T32454]  show_stack+0x18/0x24\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\n[65731.259781] [T32454]  dump_stack+0x18/0x38\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\n[65731.260047] [T32454]  notify_die+0x114/0x198\n[65731.260073] [T32454]  die+0xf4/0x5b4\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\n\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\n--\u003e be-\u003edecompressed_pages = kvcalloc(be-\u003enr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\n\tkernel panic by NULL pointer dereference.\n\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\n[65731.260339] [T32454]  read_pages+0x170/0xadc\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\n[65731.260509] [T32454]  el0_da+0x44/0x94\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:21:15.258Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91"
        },
        {
          "url": "https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da"
        },
        {
          "url": "https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc"
        }
      ],
      "title": "mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39474",
    "datePublished": "2024-07-05T06:55:05.178Z",
    "dateReserved": "2024-06-25T14:23:23.745Z",
    "dateUpdated": "2026-05-11T20:21:15.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-39474",
      "date": "2026-09-16",
      "epss": "0.00224",
      "percentile": "0.13189"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.17\", \"matchCriteriaId\": \"A37A8EE9-3F14-4C7A-A882-DA8A6AD1897C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1\", \"versionEndExcluding\": \"6.1.95\", \"matchCriteriaId\": \"FD98DE98-9D47-474B-A2EF-433D10E7459C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6\", \"versionEndExcluding\": \"6.6.34\", \"matchCriteriaId\": \"AC0C6E24-8240-425A-BD1A-F78E6D3A67FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.5\", \"matchCriteriaId\": \"54EDFD02-25E6-4BC8-9AD0-0A59881F400A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\\n\\ncommit a421ef303008 (\\\"mm: allow !GFP_KERNEL allocations for kvmalloc\\\")\\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\\ndd544141b9eb (\\\"vmalloc: back off when the current task is OOM-killed\\\").  A\\npossible scenario is as follows:\\n\\nprocess-a\\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\\n    __vmalloc_area_node()\\n        vm_area_alloc_pages()\\n\\t\\t--\u003e oom-killer send SIGKILL to process-a\\n        if (fatal_signal_pending(current)) break;\\n--\u003e return NULL;\\n\\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\\nif __GFP_NOFAIL set.\\n\\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\\n-\u003e oom-killer sends signal to process\\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\\n\\n[65731.259685] [T32454] Call trace:\\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\\n[65731.259734] [T32454]  show_stack+0x18/0x24\\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\\n[65731.259781] [T32454]  dump_stack+0x18/0x38\\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\\n[65731.260047] [T32454]  notify_die+0x114/0x198\\n[65731.260073] [T32454]  die+0xf4/0x5b4\\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\\n\\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\\n--\u003e be-\u003edecompressed_pages = kvcalloc(be-\u003enr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\\n\\tkernel panic by NULL pointer dereference.\\n\\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\\n[65731.260339] [T32454]  read_pages+0x170/0xadc\\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\\n[65731.260509] [T32454]  el0_da+0x44/0x94\\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/vmalloc: corrige vmalloc que puede devolver nulo si se llama con __GFP_NOFAIL commit a421ef303008 (\\\"mm: permitir asignaciones !GFP_KERNEL para kvmalloc\\\") incluye soporte para __GFP_NOFAIL, pero presenta un conflicto con el commit dd544141b9eb (\\\"vmalloc: retroceda cuando la tarea actual sea eliminada por OOM\\\"). Un posible escenario es el siguiente: procesar-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --\u0026gt; oom-killer env\\u00eda SIGKILL al proceso-a if (fatal_signal_pending(current)) break; --\u0026gt; devolver NULO; Para solucionar este problema, no marque fatal_signal_pending() en vm_area_alloc_pages() si __GFP_NOFAIL est\\u00e1 configurado. Este problema ocurri\\u00f3 durante la PRUEBA DE OPLUS KASAN. A continuaci\\u00f3n se muestra parte del registro -\u0026gt; oom-killer env\\u00eda se\\u00f1al para procesar [65731.222840] [T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/ uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Rastreo de llamadas: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] pila+0x18/0x24 [65731.259756] [ T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [ T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/ 0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454 ] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --\u0026gt; be-\u0026gt;decompressed_pages = kvcalloc(be-\u0026gt;nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); p\\u00e1nico del kernel por desreferencia del puntero NULL. erofs supone que kvmalloc con __GFP_NOFAIL nunca devuelve NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] c [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [ 65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c\"}]",
      "id": "CVE-2024-39474",
      "lastModified": "2024-11-21T09:27:44.577",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-05T07:15:10.190",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:27:59.000Z",
      "cve": "CVE-2024-39474",
      "id": "msrc_CVE-2024-39474",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-39474.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39474\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-05T07:15:10.190\",\"lastModified\":\"2026-06-17T07:41:59.523\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\\n\\ncommit a421ef303008 (\\\"mm: allow !GFP_KERNEL allocations for kvmalloc\\\")\\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\\ndd544141b9eb (\\\"vmalloc: back off when the current task is OOM-killed\\\").  A\\npossible scenario is as follows:\\n\\nprocess-a\\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\\n    __vmalloc_area_node()\\n        vm_area_alloc_pages()\\n\\t\\t--\u003e oom-killer send SIGKILL to process-a\\n        if (fatal_signal_pending(current)) break;\\n--\u003e return NULL;\\n\\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\\nif __GFP_NOFAIL set.\\n\\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\\n-\u003e oom-killer sends signal to process\\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\\n\\n[65731.259685] [T32454] Call trace:\\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\\n[65731.259734] [T32454]  show_stack+0x18/0x24\\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\\n[65731.259781] [T32454]  dump_stack+0x18/0x38\\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\\n[65731.260047] [T32454]  notify_die+0x114/0x198\\n[65731.260073] [T32454]  die+0xf4/0x5b4\\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\\n\\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\\n--\u003e be-\u003edecompressed_pages = kvcalloc(be-\u003enr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\\n\\tkernel panic by NULL pointer dereference.\\n\\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\\n[65731.260339] [T32454]  read_pages+0x170/0xadc\\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\\n[65731.260509] [T32454]  el0_da+0x44/0x94\\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/vmalloc: corrige vmalloc que puede devolver nulo si se llama con __GFP_NOFAIL commit a421ef303008 (\\\"mm: permitir asignaciones !GFP_KERNEL para kvmalloc\\\") incluye soporte para __GFP_NOFAIL, pero presenta un conflicto con el commit dd544141b9eb (\\\"vmalloc: retroceda cuando la tarea actual sea eliminada por OOM\\\"). Un posible escenario es el siguiente: procesar-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --\u0026gt; oom-killer env\u00eda SIGKILL al proceso-a if (fatal_signal_pending(current)) break; --\u0026gt; devolver NULO; Para solucionar este problema, no marque fatal_signal_pending() en vm_area_alloc_pages() si __GFP_NOFAIL est\u00e1 configurado. Este problema ocurri\u00f3 durante la PRUEBA DE OPLUS KASAN. A continuaci\u00f3n se muestra parte del registro -\u0026gt; oom-killer env\u00eda se\u00f1al para procesar [65731.222840] [T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/ uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Rastreo de llamadas: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] pila+0x18/0x24 [65731.259756] [ T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [ T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/ 0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454 ] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --\u0026gt; be-\u0026gt;decompressed_pages = kvcalloc(be-\u0026gt;nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); p\u00e1nico del kernel por desreferencia del puntero NULL. erofs supone que kvmalloc con __GFP_NOFAIL nunca devuelve NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] c [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [ 65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/vmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9376130c390a76fac2788a5d6e1a149017b4ab50\",\"lessThan\":\"198a80833e3421d4c9820a4ae907120adf598c91\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9376130c390a76fac2788a5d6e1a149017b4ab50\",\"lessThan\":\"c55d3564ad25ce87ab7cc6af251f9574faebd8da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9376130c390a76fac2788a5d6e1a149017b4ab50\",\"lessThan\":\"758678b65164b2158fc1de411092191cb3c394d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9376130c390a76fac2788a5d6e1a149017b4ab50\",\"lessThan\":\"8e0545c83d672750632f46e3f9ad95c48c91a0fc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/vmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.95\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.34\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.5\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-07-08T17:54:33.929150Z\",\"id\":\"CVE-2024-39474\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.17\",\"matchCriteriaId\":\"A37A8EE9-3F14-4C7A-A882-DA8A6AD1897C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.95\",\"matchCriteriaId\":\"FD98DE98-9D47-474B-A2EF-433D10E7459C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.34\",\"matchCriteriaId\":\"AC0C6E24-8240-425A-BD1A-F78E6D3A67FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.5\",\"matchCriteriaId\":\"54EDFD02-25E6-4BC8-9AD0-0A59881F400A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:56:44+00:00",
      "cve": "CVE-2024-39474",
      "id": "CVE-2024-39474",
      "initial_release_date": "2024-07-05T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "56",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-39474.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:10:49Z",
      "cve": "CVE-2024-39474",
      "id": "CVE-2024-39474",
      "initial_release_date": "2024-07-06T02:58:40Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "361",
      "product_status:recommended": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-39474",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-39474.json",
      "version": "75"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:14.977Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39474\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-08T17:54:33.929150Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-08T17:54:42.720Z\"}}], \"cna\": {\"title\": \"mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9376130c390a76fac2788a5d6e1a149017b4ab50\", \"lessThan\": \"198a80833e3421d4c9820a4ae907120adf598c91\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9376130c390a76fac2788a5d6e1a149017b4ab50\", \"lessThan\": \"c55d3564ad25ce87ab7cc6af251f9574faebd8da\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9376130c390a76fac2788a5d6e1a149017b4ab50\", \"lessThan\": \"758678b65164b2158fc1de411092191cb3c394d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9376130c390a76fac2788a5d6e1a149017b4ab50\", \"lessThan\": \"8e0545c83d672750632f46e3f9ad95c48c91a0fc\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/vmalloc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/vmalloc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91\"}, {\"url\": \"https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da\"}, {\"url\": \"https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4\"}, {\"url\": \"https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\\n\\ncommit a421ef303008 (\\\"mm: allow !GFP_KERNEL allocations for kvmalloc\\\")\\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\\ndd544141b9eb (\\\"vmalloc: back off when the current task is OOM-killed\\\").  A\\npossible scenario is as follows:\\n\\nprocess-a\\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\\n    __vmalloc_area_node()\\n        vm_area_alloc_pages()\\n\\t\\t--\u003e oom-killer send SIGKILL to process-a\\n        if (fatal_signal_pending(current)) break;\\n--\u003e return NULL;\\n\\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\\nif __GFP_NOFAIL set.\\n\\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\\n-\u003e oom-killer sends signal to process\\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\\n\\n[65731.259685] [T32454] Call trace:\\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\\n[65731.259734] [T32454]  show_stack+0x18/0x24\\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\\n[65731.259781] [T32454]  dump_stack+0x18/0x38\\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\\n[65731.260047] [T32454]  notify_die+0x114/0x198\\n[65731.260073] [T32454]  die+0xf4/0x5b4\\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\\n\\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\\n--\u003e be-\u003edecompressed_pages = kvcalloc(be-\u003enr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\\n\\tkernel panic by NULL pointer dereference.\\n\\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\\n[65731.260339] [T32454]  read_pages+0x170/0xadc\\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\\n[65731.260509] [T32454]  el0_da+0x44/0x94\\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:06:52.003Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39474\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:06:52.003Z\", \"dateReserved\": \"2024-06-25T14:23:23.745Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-05T06:55:05.178Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.