CVE-2024-50263: fork: only invoke khugepaged, ksm hooks if no error
In the Linux kernel, the following vulnerability has been resolved:
fork: only invoke khugepaged, ksm hooks if no error
There is no reason to invoke these hooks early against an mm that is in an
incomplete state.
The change in commit d24062914837 ("fork: use __mt_dup() to duplicate
maple tree in dup_mmap()") makes this more pertinent as we may be in a
state where entries in the maple tree are not yet consistent.
Their placement early in dup_mmap() only appears to have been meaningful
for early error checking, and since functionally it'd require a very small
allocation to fail (in practice 'too small to fail') that'd only occur in
the most dire circumstances, meaning the fork would fail or be OOM'd in
any case.
Since both khugepaged and KSM tracking are there to provide optimisations
to memory performance rather than critical functionality, it doesn't
really matter all that much if, under such dire memory pressure, we fail
to register an mm with these.
As a result, we follow the example of commit d2081b2bf819 ("mm:
khugepaged: make khugepaged_enter() void function") and make ksm_fork() a
void function also.
We only expose the mm to these functions once we are done with them and
only if no error occurred in the fork operation.
Security readout for executives and security teams
Plain-English summary
A Linux kernel process-creation flaw can expose partially initialized memory-management data to optimization components. The supplied CVSS assessment indicates a low-privileged local attacker could potentially compromise confidentiality, integrity, and availability. Remote, unauthenticated exploitation is not indicated.
Executive priority
Treat as a high-priority kernel update for shared, multi-user, and untrusted-workload systems. Schedule remediation promptly, but do not represent this as an actively exploited emergency based on the supplied evidence.
Technical view
During dup_mmap(), khugepaged and KSM hooks could receive an incomplete mm after maple-tree duplication errors, when entries might be inconsistent. The fix delays those hooks until duplication completes without error and changes ksm_fork() to return void.
Likely exposure
Systems running affected Linux kernel releases beginning with 6.8 may be exposed, particularly where untrusted users or workloads can execute locally. The supplied version representation is ambiguous around 6.11.7 and 6.12; confirm exact applicability with the distribution vendor.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. CISA KEV listing is false, and the supplied sources do not establish active exploitation. A public Project Zero issue exists, but its significance cannot be determined from the bundle alone.
Researcher notes
The vulnerable ordering follows commit d24062914837, which changed maple-tree duplication during fork. Failure paths could expose an inconsistent mm to khugepaged or KSM tracking. The bundle provides fixes and impact scoring but no CWE, confirmed exploitation, or complete distribution-specific version mapping.
Mitigation direction
Install a vendor-supported kernel containing the referenced stable fix.
Prioritize multi-user systems and hosts running untrusted or tenant-controlled workloads.
Restrict unnecessary local access while updates are pending.
Check distribution guidance for backported fixes and exact affected package versions.
Validation and detection
Record each system's running kernel and distribution package version.
Compare versions with vendor advisories and the referenced stable commits.
Verify the updated kernel is active after maintenance.
Confirm scanners recognize vendor backports instead of relying only on upstream version numbers.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-50263 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
4Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.