Security readout for executives and security teams
Plain-English summary
A Linux kernel locking flaw can let concurrent huge-page memory operations use different page-table locks. That race can corrupt kernel memory handling, crash systems, or potentially affect confidentiality and integrity. Exploitation requires local, low-privileged access and specific huge-page conditions; it is not described as remotely exploitable.
Executive priority
Treat as a high-priority kernel maintenance issue on exposed multi-user or huge-page-dependent systems. Prioritize environments where untrusted local users or workloads can access affected memory operations. The absence of reported active exploitation reduces immediate emergency pressure, but the potential kernel-level impact supports prompt patching and rebooting.
Technical view
GUP and hugetlb can select different locks for huge-page mappings spanning multiple PTEs or PMDs when split page-table locks are enabled. The resulting race was reproduced as a try_grab_folio warning on arm64. The fixes align huge_pte_lockptr() with core-mm locking and introduce ptep_lockptr() for PTE lock resolution.
Likely exposure
Exposure is most likely on affected Linux kernels using hugetlb mappings that span multiple PTEs or PMDs, particularly configurations with split page-table locks. The supplied version encoding lists 6.10, 6.10.7, and 6.11 boundaries ambiguously, so confirm exact affected builds against the referenced stable commits or distributor guidance.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The source provides a reproducer-triggered kernel warning, but no evidence of malicious exploitation. This CVE is not listed as KEV in the supplied bundle.
Researcher notes
The locking mismatch occurs because GUP uses the PTE or PMD table lock while hugetlb may use mm->page_table_lock. Risk depends on mapping granularity and split-lock configuration. The source also notes a powerpc 8xx corner case whose lock equivalence relies on its lack of SMP support. No CWE is supplied.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced stable fixes.
- Reboot affected systems so the corrected kernel is actively running.
- Prioritize multi-user hosts using hugetlb or architectures with multi-PTE or multi-PMD huge-page mappings.
- Consult the Linux distributor if fixed-version mapping cannot be confirmed from the referenced commits.
Validation and detection
- Inventory running kernel builds, architectures, huge-page usage, and page-table locking configuration.
- Confirm each deployed kernel contains an applicable referenced fix or distributor backport.
- After updating, verify hosts are running the intended fixed kernel.
- Review kernel logs for try_grab_folio warnings or GUP and hugetlb-related traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-45024 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7300dadba49e531af2d890ae4e34c9b115384a62CVE reference, Linux
- https://git.kernel.org/stable/c/5f75cfbd6bb02295ddaed48adf667b6c828ce07bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.