CVE-2024-47674 (GCVE-0-2024-47674)

Vulnerability from cvelistv5 – Published: 2024-10-15 10:48 – Updated: 2026-08-05 11:39
VLAI
Title
mm: avoid leaving partial pfn mappings around in error case
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'. That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order. In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries. To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b97a50adb37e98b940a30c4656565ff609aa8f94 , < 3213fdcab961026203dd587a4533600c70b3336b (git)
Affected: 69d4e1ce9087c8767f2fe9b9426fa2755c8e9072 , < 35770ca6180caa24a2b258c99a87bd437a1ee10f (git)
Affected: 74ffa5a3e68504dd289135b1cf0422c19ffb3f2e , < 5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959 (git)
Affected: 74ffa5a3e68504dd289135b1cf0422c19ffb3f2e , < 65d0db500d7c07f0f76fc24a4d837791c4862cd2 (git)
Affected: 74ffa5a3e68504dd289135b1cf0422c19ffb3f2e , < a95a24fcaee1b892e47d5e6dcc403f713874ee80 (git)
Affected: 74ffa5a3e68504dd289135b1cf0422c19ffb3f2e , < 954fd4c81f22c4b6ba65379a81fd252971bf4ef3 (git)
Affected: 74ffa5a3e68504dd289135b1cf0422c19ffb3f2e , < 79a61cc3fc0466ad2b7b89618a6157785f0293b3 (git)
Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.111 , ≤ 6.1.* (semver)
Unaffected: 6.6.52 , ≤ 6.6.* (semver)
Unaffected: 6.10.11 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T12:44:14.464782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T12:44:33.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:20:42.071Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3213fdcab961026203dd587a4533600c70b3336b",
              "status": "affected",
              "version": "b97a50adb37e98b940a30c4656565ff609aa8f94",
              "versionType": "git"
            },
            {
              "lessThan": "35770ca6180caa24a2b258c99a87bd437a1ee10f",
              "status": "affected",
              "version": "69d4e1ce9087c8767f2fe9b9426fa2755c8e9072",
              "versionType": "git"
            },
            {
              "lessThan": "5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959",
              "status": "affected",
              "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e",
              "versionType": "git"
            },
            {
              "lessThan": "65d0db500d7c07f0f76fc24a4d837791c4862cd2",
              "status": "affected",
              "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e",
              "versionType": "git"
            },
            {
              "lessThan": "a95a24fcaee1b892e47d5e6dcc403f713874ee80",
              "status": "affected",
              "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e",
              "versionType": "git"
            },
            {
              "lessThan": "954fd4c81f22c4b6ba65379a81fd252971bf4ef3",
              "status": "affected",
              "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e",
              "versionType": "git"
            },
            {
              "lessThan": "79a61cc3fc0466ad2b7b89618a6157785f0293b3",
              "status": "affected",
              "version": "74ffa5a3e68504dd289135b1cf0422c19ffb3f2e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.111",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.52",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid leaving partial pfn mappings around in error case\n\nAs Jann points out, PFN mappings are special, because unlike normal\nmemory mappings, there is no lifetime information associated with the\nmapping - it is just a raw mapping of PFNs with no reference counting of\na \u0027struct page\u0027.\n\nThat\u0027s all very much intentional, but it does mean that it\u0027s easy to\nmess up the cleanup in case of errors.  Yes, a failed mmap() will always\neventually clean up any partial mappings, but without any explicit\nlifetime in the page table mapping itself, it\u0027s very easy to do the\nerror handling in the wrong order.\n\nIn particular, it\u0027s easy to mistakenly free the physical backing store\nbefore the page tables are actually cleaned up and (temporarily) have\nstale dangling PTE entries.\n\nTo make this situation less error-prone, just make sure that any partial\npfn mapping is torn down early, before any other error handling."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the mmap(2) syscall on a local device file whose driver pfn-maps a buffer (/dev/dri/renderD*, /dev/snd/pcm*, /dev/video*, /dev/dma_heap/*, /dev/comedi*). There is no network-facing path into remap_pfn_range().\nAC:L - User page tables are allocated with GFP_PGTABLE_USER (__GFP_ACCOUNT), so an attacker holding a memcg limit can force pte_alloc/pmd_alloc to return -ENOMEM deterministically after the first PTEs are installed, choosing exactly where the walk fails. The subsequent window is exercised by a second attacker thread, so the attacker controls both sides of the race.\nPR:L - Only an open file descriptor on an ordinary unprivileged device node is needed \u2014 DRM render nodes, ALSA PCM, V4L2 and dma-heap devices are accessible to normal desktop users and to every sandboxed Android app. No capability or root is required.\nUI:N - The attacker performs the mmap(), induces the allocation failure and touches the stale mapping entirely from its own threads. No victim action is involved.\nS:U - The dangling PFN mappings and the corrupted memory are both within the kernel\u0027s own security authority; there is no VM, IOMMU or sandbox boundary crossed.\nC:H - The stale PTEs remain user-readable after the driver returns the backing pages to the page allocator, so userspace can read physical pages recycled into page tables, slab objects and other tasks\u0027 memory \u2014 an effectively arbitrary physical-memory read primitive.\nI:H - The same dangling mapping is writable (PAGE_SHARED / vm_page_prot on a PROT_WRITE mapping), giving userspace arbitrary writes into recycled kernel memory such as page tables or cred structures, which is a direct route to privilege escalation and code execution.\nA:H - Writing through PTEs pointing at freed and reallocated physical memory corrupts arbitrary kernel state, reliably producing oopses, page-table corruption and full system panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:20.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3213fdcab961026203dd587a4533600c70b3336b"
        },
        {
          "url": "https://git.kernel.org/stable/c/35770ca6180caa24a2b258c99a87bd437a1ee10f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959"
        },
        {
          "url": "https://git.kernel.org/stable/c/65d0db500d7c07f0f76fc24a4d837791c4862cd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a95a24fcaee1b892e47d5e6dcc403f713874ee80"
        },
        {
          "url": "https://git.kernel.org/stable/c/954fd4c81f22c4b6ba65379a81fd252971bf4ef3"
        },
        {
          "url": "https://git.kernel.org/stable/c/79a61cc3fc0466ad2b7b89618a6157785f0293b3"
        },
        {
          "url": "https://project-zero.issues.chromium.org/issues/366053091"
        }
      ],
      "title": "mm: avoid leaving partial pfn mappings around in error case",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47674",
    "datePublished": "2024-10-15T10:48:33.481Z",
    "dateReserved": "2024-09-30T16:00:12.937Z",
    "dateUpdated": "2026-08-05T11:39:20.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47674",
      "date": "2026-08-09",
      "epss": "0.00246",
      "percentile": "0.15826"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47674\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-15T11:15:13.073\",\"lastModified\":\"2026-06-17T07:57:30.787\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: avoid leaving partial pfn mappings around in error case\\n\\nAs Jann points out, PFN mappings are special, because unlike normal\\nmemory mappings, there is no lifetime information associated with the\\nmapping - it is just a raw mapping of PFNs with no reference counting of\\na \u0027struct page\u0027.\\n\\nThat\u0027s all very much intentional, but it does mean that it\u0027s easy to\\nmess up the cleanup in case of errors.  Yes, a failed mmap() will always\\neventually clean up any partial mappings, but without any explicit\\nlifetime in the page table mapping itself, it\u0027s very easy to do the\\nerror handling in the wrong order.\\n\\nIn particular, it\u0027s easy to mistakenly free the physical backing store\\nbefore the page tables are actually cleaned up and (temporarily) have\\nstale dangling PTE entries.\\n\\nTo make this situation less error-prone, just make sure that any partial\\npfn mapping is torn down early, before any other error handling.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: evitar dejar asignaciones pfn parciales en caso de error Como se\u00f1ala Jann, las asignaciones PFN son especiales, porque a diferencia de las asignaciones de memoria normales, no hay informaci\u00f3n de duraci\u00f3n asociada con la asignaci\u00f3n: es solo una asignaci\u00f3n sin procesar de PFN sin recuento de referencias de una \u0027p\u00e1gina de estructura\u0027. Todo eso es muy intencional, pero significa que es f\u00e1cil arruinar la limpieza en caso de errores. S\u00ed, un mmap() fallido siempre limpiar\u00e1 eventualmente cualquier asignaci\u00f3n parcial, pero sin ninguna duraci\u00f3n expl\u00edcita en la asignaci\u00f3n de la tabla de p\u00e1ginas en s\u00ed, es muy f\u00e1cil hacer el manejo de errores en el orden incorrecto. En particular, es f\u00e1cil liberar por error el almacenamiento de respaldo f\u00edsico antes de que las tablas de p\u00e1ginas se limpien realmente y (temporalmente) tengan entradas PTE colgantes obsoletas. Para hacer que esta situaci\u00f3n sea menos propensa a errores, simplemente aseg\u00farese de que cualquier asignaci\u00f3n pfn parcial se elimine temprano, antes de cualquier otro manejo de errores.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b97a50adb37e98b940a30c4656565ff609aa8f94\",\"lessThan\":\"3213fdcab961026203dd587a4533600c70b3336b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"69d4e1ce9087c8767f2fe9b9426fa2755c8e9072\",\"lessThan\":\"35770ca6180caa24a2b258c99a87bd437a1ee10f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\",\"lessThan\":\"5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\",\"lessThan\":\"65d0db500d7c07f0f76fc24a4d837791c4862cd2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\",\"lessThan\":\"a95a24fcaee1b892e47d5e6dcc403f713874ee80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\",\"lessThan\":\"954fd4c81f22c4b6ba65379a81fd252971bf4ef3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\",\"lessThan\":\"79a61cc3fc0466ad2b7b89618a6157785f0293b3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.111\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.52\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.11\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-15T12:44:14.464782Z\",\"id\":\"CVE-2024-47674\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-459\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"F032D82B-5582-4DF5-B921-BFE0BD301364\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.111\",\"matchCriteriaId\":\"FCBCD375-91FC-4790-94C0-6FF9C68F6498\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.52\",\"matchCriteriaId\":\"02ADDA94-95BB-484D-8E95-63C0428A28E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.11\",\"matchCriteriaId\":\"F5DB5367-F1F5-4200-B3B3-FDF8AFC3D255\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE5298B3-04B4-4F3E-B186-01A58B5C75A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3213fdcab961026203dd587a4533600c70b3336b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/35770ca6180caa24a2b258c99a87bd437a1ee10f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/65d0db500d7c07f0f76fc24a4d837791c4862cd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/79a61cc3fc0466ad2b7b89618a6157785f0293b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/954fd4c81f22c4b6ba65379a81fd252971bf4ef3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a95a24fcaee1b892e47d5e6dcc403f713874ee80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://project-zero.issues.chromium.org/issues/366053091\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:41:45+00:00",
      "cve": "CVE-2024-47674",
      "id": "CVE-2024-47674",
      "initial_release_date": "2024-10-15T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: avoid leaving partial pfn mappings around in error case",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47674.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:20:42.071Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47674\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T12:44:14.464782Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T12:44:18.597Z\"}}], \"cna\": {\"title\": \"mm: avoid leaving partial pfn mappings around in error case\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b97a50adb37e98b940a30c4656565ff609aa8f94\", \"lessThan\": \"3213fdcab961026203dd587a4533600c70b3336b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69d4e1ce9087c8767f2fe9b9426fa2755c8e9072\", \"lessThan\": \"35770ca6180caa24a2b258c99a87bd437a1ee10f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\", \"lessThan\": \"5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\", \"lessThan\": \"65d0db500d7c07f0f76fc24a4d837791c4862cd2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\", \"lessThan\": \"a95a24fcaee1b892e47d5e6dcc403f713874ee80\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\", \"lessThan\": \"954fd4c81f22c4b6ba65379a81fd252971bf4ef3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ffa5a3e68504dd289135b1cf0422c19ffb3f2e\", \"lessThan\": \"79a61cc3fc0466ad2b7b89618a6157785f0293b3\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/memory.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.111\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.52\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/memory.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3213fdcab961026203dd587a4533600c70b3336b\"}, {\"url\": \"https://git.kernel.org/stable/c/35770ca6180caa24a2b258c99a87bd437a1ee10f\"}, {\"url\": \"https://git.kernel.org/stable/c/5b2c8b34f6d76bfbd1dd4936eb8a0fbfb9af3959\"}, {\"url\": \"https://git.kernel.org/stable/c/65d0db500d7c07f0f76fc24a4d837791c4862cd2\"}, {\"url\": \"https://git.kernel.org/stable/c/a95a24fcaee1b892e47d5e6dcc403f713874ee80\"}, {\"url\": \"https://git.kernel.org/stable/c/954fd4c81f22c4b6ba65379a81fd252971bf4ef3\"}, {\"url\": \"https://git.kernel.org/stable/c/79a61cc3fc0466ad2b7b89618a6157785f0293b3\"}, {\"url\": \"https://project-zero.issues.chromium.org/issues/366053091\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: avoid leaving partial pfn mappings around in error case\\n\\nAs Jann points out, PFN mappings are special, because unlike normal\\nmemory mappings, there is no lifetime information associated with the\\nmapping - it is just a raw mapping of PFNs with no reference counting of\\na \u0027struct page\u0027.\\n\\nThat\u0027s all very much intentional, but it does mean that it\u0027s easy to\\nmess up the cleanup in case of errors.  Yes, a failed mmap() will always\\neventually clean up any partial mappings, but without any explicit\\nlifetime in the page table mapping itself, it\u0027s very easy to do the\\nerror handling in the wrong order.\\n\\nIn particular, it\u0027s easy to mistakenly free the physical backing store\\nbefore the page tables are actually cleaned up and (temporarily) have\\nstale dangling PTE entries.\\n\\nTo make this situation less error-prone, just make sure that any partial\\npfn mapping is torn down early, before any other error handling.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.111\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.52\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.11\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:54:01.506Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47674\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:54:01.506Z\", \"dateReserved\": \"2024-09-30T16:00:12.937Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-15T10:48:33.481Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.