Linux Kernel PMD Counter Update Race Condition

Executive Summary

This vulnerability exists in the Linux kernel's memory management code related to huge pages. Specifically, the function __split_huge_pmd_locked() updates the file or shared memory RSS (Resident Set Size) counter after it has dropped the PMD (Page Middle Directory) mapping's folio reference. If the folio_put() function drops the last reference to the folio, the mm_counter_file() function may later read from a freed folio state via folio_test_swapbacked(), which can lead to incorrect memory accounting or potential use-after-free issues.

The fix involves moving the update of the counter to occur before calling folio_put(), ensuring that the counter is updated while the folio reference is still valid.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect memory accounting in the Linux kernel, which might cause system instability or unexpected behavior in memory management. If the kernel reads freed memory state, it could potentially lead to use-after-free conditions, which in some cases might be exploitable to cause crashes or escalate privileges.

Useful 0 Not Useful 0