5.5

CVE-2024-40914: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-40914DEBIAN-CVE-2024-40914
Published 12-07-2024Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2024-40914 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.8% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.28%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 21
DLA-4008-1DSA-5731-1RHSA-2024:5928RHSA-2024:6267RHSA-2024:6268SUSE-SU-2024:4314-1

Timeline

  1. 12-07-2024
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 137 Comm: kswapd1 Not tainted 6.9.0-rc4-00491-gd5ce28f156fe-dirty #14 RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 Call Trace: <TASK> do_shrink_slab+0x14f/0x6a0 shrink_slab+0xca/0x8c0 shrink_node+0x2d0/0x7d0 balance_pgdat+0x33a/0x720 kswapd+0x1f3/0x410 kthread+0xd5/0x100 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: mce_inject hwpoison_inject ---[ end trace 0000000000000000 ]--- RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 The root cause is that HWPoison flag will be set for huge_zero_folio without increasing the folio refcnt. But then unpoison_memory() will decrease the folio refcnt unexpectedly as it appears like a successfully hwpoisoned folio leading to VM_BUG_ON_PAGE(page_ref_count(page) == 0) when releasing huge_zero_folio. Skip unpoisoning huge_zero_folio in unpoison_memory() to fix this issue. We're not prepared to unpoison huge_zero_folio yet.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

0.00 pp

From 0.28% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu116 products
  • linux< 5.15.0-121.131 | < 6.8.0-44.44
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1069.75 | < 6.8.0-1015.16
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ f8f836100fff594cea8a0a027affb9d5520f09a7, < 688bb46ad339497b5b7f527b6636d2afe04b46af | ≥ 478d134e9506c7e9bfe2830ed03dd85e97966313, < b2494506f30675245a3e6787281f79601af087bf | ≥ 478d134e9506c7e9bfe2830ed03dd85e97966313, < 0d73477af964dbd7396163a13817baf13940bca9 | ≥ 478d134e9506c7e9bfe2830ed03dd85e97966313, < d72b7711919de49d92a67dfc844a6cf4c23dd794 | ≥ 478d134e9506c7e9bfe2830ed03dd85e97966313, < fe6f86f4b40855a130a19aa589f9ba7f650423f4 | 13d9b8cd12f37d133b07ea5b323583e8a0c6b738 | ≥ 5.15.41, < 5.15.162 | ≥ 5.17.9, < 5.18 | 5.18
  • linux_kernelEOL≥ 5.15.41, < 5.15.162 | ≥ 5.17.9, < 5.18 | ≥ 5.18.1, < 6.1.95 | ≥ 6.2, < 6.6.35 | ≥ 6.7, < 6.9.6 | 5.18 | 5.18:rc7
Debian1 product
  • linux< 6.1.99-1 | < 6.9.7-1

3 vendors · 119 products

References

23 links
Show all 23 references