CVE-2021-46988

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises when userspace issues a UFFD ioctl, which calls into shmem mfill atomic pte(). If the copy from user() fails after successfully accounting blocks and allocating a page with shmem alloc page(), the error code -ENOENT is returned without releasing the allocated page. This can lead to a situation where another process fills up the tmpfs, causing shmem mfill atomic pte() to fail when retried, resulting in a BUG ON assertion failure because the page is not consumed. The fix involves detecting and releasing any "dangling" pages when accounting fails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.