LiveActive security incident?Get immediate response
CVE Record

CVE-2024-42131: mm: avoid overflows in dirty throttling logic

In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix these problems by never allowing so large dirty limits as they have dubious practical value anyway. For dirty_bytes / dirty_background_bytes interfaces we can just refuse to set so large limits. For dirty_ratio / dirty_background_ratio it isn't so simple as the dirty limit is computed from the amount of available memory which can change due to memory hotplug etc. So when converting dirty limits from ratios to numbers of pages, we just don't allow the result to exceed UINT_MAX. This is root-only triggerable problem which occurs when the operator sets dirty limits to >16 TB.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects dirty memory throttling when extremely large dirty limits are configured. The source says it is root-only triggerable and occurs when an operator sets dirty limits above 16 TB. Business urgency is low for typical systems, but large-memory hosts and custom kernel/sysctl configurations should be checked.

Executive priority

Treat as a targeted maintenance item, not an emergency, unless your fleet includes very large Linux systems with custom dirty memory tuning. Prioritize through normal kernel patch cycles and configuration review.

Technical view

Dirty throttling logic assumed page-based dirty limits fit within 32-bit values, creating overflow and possible divide-by-zero conditions when limits became too large. The fix caps ratio-derived dirty limits at UINT_MAX and rejects oversized dirty_bytes and dirty_background_bytes settings. Sources identify Linux kernel affected versions and stable commit references.

Likely exposure

Exposure is most plausible on Linux systems where privileged administrators or automation configure unusually large vm dirty limits, especially large-memory or memory-hotplug environments. Default or ordinary server configurations are less likely to reach the described condition.

Exploitation context

The source bundle states this is root-only triggerable and requires dirty limits greater than 16 TB. KEV is false, and the provided sources do not claim active exploitation, public weaponization, or remote unauthenticated reachability.

Researcher notes

The key constraint is local privileged configuration. The sources do not provide CVSS, CWE, exploit reports, or a precise runtime impact beyond overflow and possible division-by-zero behavior. Avoid expanding scope beyond Linux kernel dirty throttling logic.

Mitigation direction

  • Update affected Linux kernels to vendor builds containing the referenced stable fixes.
  • Avoid configuring dirty_bytes or dirty_background_bytes above practical vendor-supported limits.
  • Review dirty_ratio and dirty_background_ratio use on very large-memory systems.
  • Track distribution advisories, including Debian LTS if applicable.
  • Do not deploy kernels until standard unit, regression, and operational tests pass.

Validation and detection

  • Inventory Linux kernel versions against the affected and fixed vendor ranges.
  • Review vm dirty limit settings for values that could exceed 16 TB.
  • Check large-memory and memory-hotplug hosts first.
  • Confirm installed kernel packages include the referenced stable fix lineage.
  • Document whether local automation manages dirty throttling sysctls.
Prepared
Confidence
high
Sources
11

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-42131 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9, 2da02997e08d3efe8174c7a47696e6f7cbe69ba9unaffected
LinuxLinux2.6.29, 0, 4.19.320, 5.4.282, 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.9, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.