mm: avoid leaving partial pfn mappings around in error case
As Jann points out, PFN mappings are special, because unlike normal
memory mappings, there is no lifetime information associated with the
mapping - it is just a raw mapping of PFNs with no reference counting of
a 'struct page'.
That's all very much intentional, but it does mean that it's easy to
mess up the cleanup in case of errors. Yes, a failed mmap() will always
eventually clean up any partial mappings, but without any explicit
lifetime in the page table mapping itself, it's very easy to do the
error handling in the wrong order.
In particular, it's easy to mistakenly free the physical backing store
before the page tables are actually cleaned up and (temporarily) have
stale dangling PTE entries.
To make this situation less error-prone, just make sure that any partial
pfn mapping is torn down early, before any other error handling.
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4008-1 | linux-6.1 security update |
Debian DLA |
DLA-4075-1 | linux security update |
Ubuntu USN |
USN-7154-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7155-1 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-7156-1 | Linux kernel (GKE) vulnerabilities |
Ubuntu USN |
USN-7166-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7166-2 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7166-3 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7154-2 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7166-4 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7186-1 | Linux kernel (Intel IoTG) vulnerabilities |
Ubuntu USN |
USN-7186-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7194-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7196-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7293-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7294-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7294-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7294-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7294-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7295-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7393-1 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7401-1 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7413-1 | Linux kernel (IoT) vulnerabilities |
Ubuntu USN |
USN-7539-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7540-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 03 Nov 2025 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 03 Nov 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 11 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Sun, 17 Nov 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 08 Nov 2024 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 23 Oct 2024 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 |
Mon, 21 Oct 2024 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 18 Oct 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-459 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
Thu, 17 Oct 2024 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 16 Oct 2024 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Tue, 15 Oct 2024 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 15 Oct 2024 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'. That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order. In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries. To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling. | |
| Title | mm: avoid leaving partial pfn mappings around in error case | |
| References |
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-11-03T22:20:42.071Z
Reserved: 2024-09-30T16:00:12.937Z
Link: CVE-2024-47674
Updated: 2024-10-15T12:44:18.597Z
Status : Modified
Published: 2024-10-15T11:15:13.073
Modified: 2025-11-03T23:16:15.420
Link: CVE-2024-47674
OpenCVE Enrichment
No data.
Debian DLA
Ubuntu USN