{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52935","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-08-21T06:07:11.020Z","datePublished":"2025-03-27T16:37:15.505Z","dateUpdated":"2026-08-05T09:12:10.045Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:12:10.045Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: fix ->anon_vma race\n\nIf an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires\nit to be locked.\n\nPage table traversal is allowed under any one of the mmap lock, the\nanon_vma lock (if the VMA is associated with an anon_vma), and the\nmapping lock (if the VMA is associated with a mapping); and so to be\nable to remove page tables, we must hold all three of them. \nretract_page_tables() bails out if an ->anon_vma is attached, but does\nthis check before holding the mmap lock (as the comment above the check\nexplains).\n\nIf we racily merged an existing ->anon_vma (shared with a child\nprocess) from a neighboring VMA, subsequent rmap traversals on pages\nbelonging to the child will be able to see the page tables that we are\nconcurrently removing while assuming that nothing else can access them.\n\nRepeat the ->anon_vma check once we hold the mmap lock to ensure that\nthere really is no concurrent page table access.\n\nHitting this bug causes a lockdep warning in collapse_and_free_pmd(),\nin the line \"lockdep_assert_held_write(&vma->anon_vma->root->rwsem)\". \nIt can also lead to use-after-free access."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached only through local memory-management operations (memfd/mmap MAP_PRIVATE, mremap, MADV_COLLAPSE or khugepaged, page faults, MADV_PAGEOUT), not via network packet processing.\nAC:L - The attacker controls both sides of the race with concurrent threads—one triggering retract_page_tables via MADV_COLLAPSE (or waiting on khugepaged) while another attaches anon_vma and forces an rmap walk—and can retry until the TOCTOU window is hit.\nPR:L - An unprivileged local user can trigger the bug using memfd, private mappings, MADV_COLLAPSE (which bypasses shmem_enabled unless DENY), and madvise/faults with no capabilities or user-namespace tricks required.\nUI:N - Exploitation requires no victim action; the attacker fully sets up the VMA layout and triggers collapse and rmap walks themselves.\nS:U - Impact is confined to the host kernel’s memory-management authority (local privilege escalation via page-table UAF), not a cross-boundary escape such as guest-to-host.\nC:H - Confirmed use-after-free of a freed page-table page during rmap walks yields a strong arbitrary-read primitive over kernel/physical memory once the PTE page is reallocated under attacker control.\nI:H - Page-table UAF enables heap spraying of the freed PTE page and arbitrary PTE installation, providing write primitives and control-flow hijacking for local privilege escalation.\nA:H - The same UAF produces kernel oops/panic (demonstrated by KASAN use-after-free in page_vma_mapped_walk) even when not fully exploited for code execution."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/khugepaged.c"],"versions":[{"version":"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30","lessThan":"352fbf61ce776fef18dca6a68680a6cd943dac95","status":"affected","versionType":"git"},{"version":"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30","lessThan":"cee956ab1efbd858b4ca61c8b474af5aa24b29a6","status":"affected","versionType":"git"},{"version":"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30","lessThan":"abdf3c33918185c3e8ffeb09ed3e334b3d7df47c","status":"affected","versionType":"git"},{"version":"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30","lessThan":"acb08187b5a83cdb9ac4112fae9e18cf983b0128","status":"affected","versionType":"git"},{"version":"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30","lessThan":"023f47a8250c6bdb4aebe744db4bf7f73414028b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/khugepaged.c"],"versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","status":"unaffected","versionType":"semver"},{"version":"5.4.299","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.243","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.192","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.11","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.4.299"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.10.243"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.15.192"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/352fbf61ce776fef18dca6a68680a6cd943dac95"},{"url":"https://git.kernel.org/stable/c/cee956ab1efbd858b4ca61c8b474af5aa24b29a6"},{"url":"https://git.kernel.org/stable/c/abdf3c33918185c3e8ffeb09ed3e334b3d7df47c"},{"url":"https://git.kernel.org/stable/c/acb08187b5a83cdb9ac4112fae9e18cf983b0128"},{"url":"https://git.kernel.org/stable/c/023f47a8250c6bdb4aebe744db4bf7f73414028b"}],"title":"mm/khugepaged: fix ->anon_vma race","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-52935","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-03-28T15:22:40.271006Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-03-28T15:31:59.667Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:31:05.059Z"}}]}}