Memory Corruption in Linux Kernel mm/zone_device

Executive Summary

This vulnerability exists in the Linux kernel's memory management subsystem, specifically in the handling of device folios within the mm/zone_device component.

The issue arises because after calling the folio_free() function on a device folio, the contents of that folio can immediately change. This happens because the folio may be reallocated by a driver with a different order.

The vulnerability is due to touching or accessing the device folio after calling folio_free(), which is unsafe. The correct approach is to use a local stack variable to hold necessary information before calling percpu_ref_put_many(), avoiding accessing the folio after it might have been reallocated.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability involves improper handling of device folios in the Linux kernel, where the contents of a device folio can change immediately after calling the folio_free() function. This can lead to potential memory corruption or unexpected behavior in kernel drivers that manage device memory, possibly causing system instability or crashes.

Useful 0 Not Useful 0