LiveActive security incident?Get immediate response
CVE Record

CVE-2024-50263: fork: only invoke khugepaged, ksm hooks if no error

In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reason to invoke these hooks early against an mm that is in an incomplete state. The change in commit d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") makes this more pertinent as we may be in a state where entries in the maple tree are not yet consistent. Their placement early in dup_mmap() only appears to have been meaningful for early error checking, and since functionally it'd require a very small allocation to fail (in practice 'too small to fail') that'd only occur in the most dire circumstances, meaning the fork would fail or be OOM'd in any case. Since both khugepaged and KSM tracking are there to provide optimisations to memory performance rather than critical functionality, it doesn't really matter all that much if, under such dire memory pressure, we fail to register an mm with these. As a result, we follow the example of commit d2081b2bf819 ("mm: khugepaged: make khugepaged_enter() void function") and make ksm_fork() a void function also. We only expose the mm to these functions once we are done with them and only if no error occurred in the fork operation.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel process-creation flaw can expose partially initialized memory-management data to optimization components. The supplied CVSS assessment indicates a low-privileged local attacker could potentially compromise confidentiality, integrity, and availability. Remote, unauthenticated exploitation is not indicated.

Executive priority

Treat as a high-priority kernel update for shared, multi-user, and untrusted-workload systems. Schedule remediation promptly, but do not represent this as an actively exploited emergency based on the supplied evidence.

Technical view

During dup_mmap(), khugepaged and KSM hooks could receive an incomplete mm after maple-tree duplication errors, when entries might be inconsistent. The fix delays those hooks until duplication completes without error and changes ksm_fork() to return void.

Likely exposure

Systems running affected Linux kernel releases beginning with 6.8 may be exposed, particularly where untrusted users or workloads can execute locally. The supplied version representation is ambiguous around 6.11.7 and 6.12; confirm exact applicability with the distribution vendor.

Exploitation context

The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. CISA KEV listing is false, and the supplied sources do not establish active exploitation. A public Project Zero issue exists, but its significance cannot be determined from the bundle alone.

Researcher notes

The vulnerable ordering follows commit d24062914837, which changed maple-tree duplication during fork. Failure paths could expose an inconsistent mm to khugepaged or KSM tracking. The bundle provides fixes and impact scoring but no CWE, confirmed exploitation, or complete distribution-specific version mapping.

Mitigation direction

  • Install a vendor-supported kernel containing the referenced stable fix.
  • Prioritize multi-user systems and hosts running untrusted or tenant-controlled workloads.
  • Restrict unnecessary local access while updates are pending.
  • Check distribution guidance for backported fixes and exact affected package versions.

Validation and detection

  • Record each system's running kernel and distribution package version.
  • Compare versions with vendor advisories and the referenced stable commits.
  • Verify the updated kernel is active after maintenance.
  • Confirm scanners recognize vendor backports instead of relying only on upstream version numbers.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-50263 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-50263Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd2406291483775ecddaee929231a39c70c08fda2, d2406291483775ecddaee929231a39c70c08fda2unaffected
LinuxLinux6.8, 0, 6.11.7, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.