CVE-2024-41027

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.43

Description The issue is related to the userfaultfd api() function in the Linux kernel, which is associated with resource management errors. If a feature is not set in the Kernel config, the function fails silently and returns all available features, instead of returning an EINVAL as indicated by the man page. This can lead to a Kernel warning if a program requests the UFFD FEATURE WP UNPOPULATED feature on a kernel with the config not set for this feature. The vulnerability can be exploited to cause a denial of service.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.43 or later. As a temporary workaround, consider restricting the use of the userfaultfd api() function until a patch is available. Avoid requesting the UFFD FEATURE WP UNPOPULATED feature on kernels with the config not set for this feature to minimize the risk of exploitation.