GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47676 (GCVE-0-2024-47676)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-08-05 11:39
VLAI
Title
mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway Syzbot reports a UAF in hugetlb_fault(). This happens because vmf_anon_prepare() could drop the per-VMA lock and allow the current VMA to be freed before hugetlb_vma_unlock_read() is called. We can fix this by using a modified version of vmf_anon_prepare() that doesn't release the VMA lock on failure, and then release it ourselves after hugetlb_vma_unlock_read().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:07 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c , < e897d184a8dd4a4e1f39c8c495598e4d9472776c (git)
Affected: 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c , < d59ebc99dee0a2687a26df94b901eb8216dbf876 (git)
Affected: 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c , < 98b74bb4d7e96b4da5ef3126511febe55b76b807 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:07:59.972172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:17.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e897d184a8dd4a4e1f39c8c495598e4d9472776c",
              "status": "affected",
              "version": "9acad7ba3e25d11f4c96df1b7312ae89e6faca5c",
              "versionType": "git"
            },
            {
              "lessThan": "d59ebc99dee0a2687a26df94b901eb8216dbf876",
              "status": "affected",
              "version": "9acad7ba3e25d11f4c96df1b7312ae89e6faca5c",
              "versionType": "git"
            },
            {
              "lessThan": "98b74bb4d7e96b4da5ef3126511febe55b76b807",
              "status": "affected",
              "version": "9acad7ba3e25d11f4c96df1b7312ae89e6faca5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb.c: fix UAF of vma in hugetlb fault pathway\n\nSyzbot reports a UAF in hugetlb_fault().  This happens because\nvmf_anon_prepare() could drop the per-VMA lock and allow the current VMA\nto be freed before hugetlb_vma_unlock_read() is called.\n\nWe can fix this by using a modified version of vmf_anon_prepare() that\ndoesn\u0027t release the VMA lock on failure, and then release it ourselves\nafter hugetlb_vma_unlock_read()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by a page fault on a hugetlb mapping in the attacker\u0027s own address space, requiring local execution of code on the target system. There is no network-reachable path into `hugetlb_fault()`.\nAC:L - The attacker controls every side of the race \u2014 the faulting thread, the sibling thread holding `mmap_lock` for write that forces `mmap_read_trylock()` to fail, and the `munmap()` thread that frees the VMA \u2014 and can retry the fault indefinitely. Syzbot reproduced the UAF, confirming it is reliably triggerable.\nPR:L - Any unprivileged local user can create the required private hugetlb VMA via `memfd_create(MFD_HUGETLB)` or `mmap(MAP_HUGETLB|MAP_NORESERVE)` with no capability check, and the UAF path in `hugetlb_no_page()` is reached before any hugepage allocation is attempted. No CAP_* or root is needed.\nUI:N - The attacker\u0027s own threads perform the mapping, faulting, and unmapping entirely on their own; no victim action or interaction of any kind is required.\nS:U - The corruption is of a `vm_area_struct` in kernel slab memory belonging to the attacker\u0027s own mm, handled by the kernel itself. It is a standard in-kernel memory-safety issue with no crossing of a VM, IOMMU, or other security-authority boundary.\nC:H - After the VMA is freed, `hugetlb_vma_unlock_read()` reads `vma-\u003evm_flags` and `vma-\u003evm_private_data` from reclaimed slab memory, so an attacker who grooms the freed `vm_area_struct` can steer subsequent dereferences and leverage the UAF for kernel memory disclosure.\nI:H - The stale `vma-\u003evm_private_data` is used as a `hugetlb_vma_lock`/`resv_map` pointer and `up_read()` performs an atomic decrement plus possible waiter-list manipulation at that attacker-influenced address, giving a controllable kernel write primitive suitable for privilege escalation via heap spraying.\nA:H - Dereferencing a freed `vm_area_struct` and operating an rwsem derived from reclaimed memory readily causes kernel oops, rwsem-state corruption, or panic, and the attacker can trigger it repeatedly at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:22.950Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e897d184a8dd4a4e1f39c8c495598e4d9472776c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d59ebc99dee0a2687a26df94b901eb8216dbf876"
        },
        {
          "url": "https://git.kernel.org/stable/c/98b74bb4d7e96b4da5ef3126511febe55b76b807"
        }
      ],
      "title": "mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47676",
    "datePublished": "2024-10-21T11:53:20.482Z",
    "dateReserved": "2024-09-30T16:00:12.938Z",
    "dateUpdated": "2026-08-05T11:39:22.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47676",
      "date": "2026-09-17",
      "epss": "0.00241",
      "percentile": "0.1544"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47676\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:04.687\",\"lastModified\":\"2026-08-04T11:20:38.827\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb.c: fix UAF of vma in hugetlb fault pathway\\n\\nSyzbot reports a UAF in hugetlb_fault().  This happens because\\nvmf_anon_prepare() could drop the per-VMA lock and allow the current VMA\\nto be freed before hugetlb_vma_unlock_read() is called.\\n\\nWe can fix this by using a modified version of vmf_anon_prepare() that\\ndoesn\u0027t release the VMA lock on failure, and then release it ourselves\\nafter hugetlb_vma_unlock_read().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/hugetlb.c: correcci\u00f3n del UAF de vma en la ruta de error hugetlb Syzbot informa un UAF en hugetlb_fault(). Esto sucede porque vmf_anon_prepare() podr\u00eda eliminar el bloqueo por VMA y permitir que se libere el VMA actual antes de que se llame a hugetlb_vma_unlock_read(). Podemos solucionar esto utilizando una versi\u00f3n modificada de vmf_anon_prepare() que no libere el bloqueo de VMA en caso de error y luego lo liberemos nosotros mismos despu\u00e9s de hugetlb_vma_unlock_read().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9acad7ba3e25d11f4c96df1b7312ae89e6faca5c\",\"lessThan\":\"e897d184a8dd4a4e1f39c8c495598e4d9472776c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9acad7ba3e25d11f4c96df1b7312ae89e6faca5c\",\"lessThan\":\"d59ebc99dee0a2687a26df94b901eb8216dbf876\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9acad7ba3e25d11f4c96df1b7312ae89e6faca5c\",\"lessThan\":\"98b74bb4d7e96b4da5ef3126511febe55b76b807\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:07:59.972172Z\",\"id\":\"CVE-2024-47676\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"451C50ED-169E-4E8C-BFD9-95D0C8C3231C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/98b74bb4d7e96b4da5ef3126511febe55b76b807\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d59ebc99dee0a2687a26df94b901eb8216dbf876\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e897d184a8dd4a4e1f39c8c495598e4d9472776c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:02:51+00:00",
      "cve": "CVE-2024-47676",
      "id": "CVE-2024-47676",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47676.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47676\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:07:59.972172Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:08:03.311Z\"}}], \"cna\": {\"title\": \"mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is triggered by a page fault on a hugetlb mapping in the attacker\u0027s own address space, requiring local execution of code on the target system. There is no network-reachable path into `hugetlb_fault()`.\\nAC:L - The attacker controls every side of the race \\u2014 the faulting thread, the sibling thread holding `mmap_lock` for write that forces `mmap_read_trylock()` to fail, and the `munmap()` thread that frees the VMA \\u2014 and can retry the fault indefinitely. Syzbot reproduced the UAF, confirming it is reliably triggerable.\\nPR:L - Any unprivileged local user can create the required private hugetlb VMA via `memfd_create(MFD_HUGETLB)` or `mmap(MAP_HUGETLB|MAP_NORESERVE)` with no capability check, and the UAF path in `hugetlb_no_page()` is reached before any hugepage allocation is attempted. No CAP_* or root is needed.\\nUI:N - The attacker\u0027s own threads perform the mapping, faulting, and unmapping entirely on their own; no victim action or interaction of any kind is required.\\nS:U - The corruption is of a `vm_area_struct` in kernel slab memory belonging to the attacker\u0027s own mm, handled by the kernel itself. It is a standard in-kernel memory-safety issue with no crossing of a VM, IOMMU, or other security-authority boundary.\\nC:H - After the VMA is freed, `hugetlb_vma_unlock_read()` reads `vma-\u003evm_flags` and `vma-\u003evm_private_data` from reclaimed slab memory, so an attacker who grooms the freed `vm_area_struct` can steer subsequent dereferences and leverage the UAF for kernel memory disclosure.\\nI:H - The stale `vma-\u003evm_private_data` is used as a `hugetlb_vma_lock`/`resv_map` pointer and `up_read()` performs an atomic decrement plus possible waiter-list manipulation at that attacker-influenced address, giving a controllable kernel write primitive suitable for privilege escalation via heap spraying.\\nA:H - Dereferencing a freed `vm_area_struct` and operating an rwsem derived from reclaimed memory readily causes kernel oops, rwsem-state corruption, or panic, and the attacker can trigger it repeatedly at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9acad7ba3e25d11f4c96df1b7312ae89e6faca5c\", \"lessThan\": \"e897d184a8dd4a4e1f39c8c495598e4d9472776c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9acad7ba3e25d11f4c96df1b7312ae89e6faca5c\", \"lessThan\": \"d59ebc99dee0a2687a26df94b901eb8216dbf876\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9acad7ba3e25d11f4c96df1b7312ae89e6faca5c\", \"lessThan\": \"98b74bb4d7e96b4da5ef3126511febe55b76b807\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/hugetlb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/hugetlb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e897d184a8dd4a4e1f39c8c495598e4d9472776c\"}, {\"url\": \"https://git.kernel.org/stable/c/d59ebc99dee0a2687a26df94b901eb8216dbf876\"}, {\"url\": \"https://git.kernel.org/stable/c/98b74bb4d7e96b4da5ef3126511febe55b76b807\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb.c: fix UAF of vma in hugetlb fault pathway\\n\\nSyzbot reports a UAF in hugetlb_fault().  This happens because\\nvmf_anon_prepare() could drop the per-VMA lock and allow the current VMA\\nto be freed before hugetlb_vma_unlock_read() is called.\\n\\nWe can fix this by using a modified version of vmf_anon_prepare() that\\ndoesn\u0027t release the VMA lock on failure, and then release it ourselves\\nafter hugetlb_vma_unlock_read().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:39:22.950Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47676\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:39:22.950Z\", \"dateReserved\": \"2024-09-30T16:00:12.938Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:20.482Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.