Executive Summary

This vulnerability exists in the Linux kernel's memory management subsystem, specifically in the vmalloc area. The function decay_va_pool_node() can be called concurrently from two different paths: one when memory pools are being purged (__purge_vmap_area_lazy()) and another via the shrinker mechanism (vmap_node_shrink_scan()).

The problem is that decay_va_pool_node() is not designed to be safe when run concurrently, and the shrinker path does not have proper serialization. This lack of synchronization can lead to race conditions and potentially cause memory leaks.

The fix involves protecting decay_va_pool_node() by acquiring the vmap_purge_lock in the shrinker path to ensure that these operations are serialized and do not run concurrently.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to race conditions in the Linux kernel's memory management, which may cause memory leaks. Memory leaks can degrade system performance over time, potentially leading to resource exhaustion.

In critical systems, such leaks might cause instability or crashes, affecting system reliability and availability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by ensuring that decay_va_pool_node() is protected by taking the vmap_purge_lock in the shrinker path to prevent concurrent execution and race conditions.

To mitigate this vulnerability immediately, update your Linux kernel to a version that includes this fix where vmap_purge_lock is taken in the shrinker path.

Useful 0 Not Useful 0