CVE-2024-39298

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The vulnerability is related to the handling of dissolved but not taken off from buddy pages in the Linux kernel's memory failure module. This can cause a kernel panic due to a bad page state. The root cause of the issue is a race condition between the memory failure and try memory failure hugetlb functions, specifically in the me huge page function. The vulnerability can be exploited by an attacker to cause a denial of service.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.37 or later. If updating is not possible, consider disabling the me huge page function or restricting access to the vulnerable module as a temporary workaround. However, these workarounds may have performance implications and should be thoroughly tested before implementation.