Linux 6.6 Race Condition

Summary I found a security-relevant race between mremap and THP code. Reaching the buggy code typically requires the ability to create unprivileged namespaces. The bug leads to installing physical address 0 as a page table, which is likely exploitable in several ways: For example, triggering the...

CVE-2024-50066

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix movenormalpmd/retractpagetables race In mremap, movepagetables looks at the type of the PMD entry and the specified address range to figure out by which method the next chunk of page table entries should be moved. ...

PT-2024-10100

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to a race condition in the move page tables function, specifically between move normal pmd and retract page tables in the THP code. This can lead to the creation of bogus P...