{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-53105","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-11-19T17:17:24.992Z","datePublished":"2024-12-02T13:44:38.257Z","dateUpdated":"2025-11-03T20:45:56.207Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T09:53:09.220Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_alloc: move mlocked flag clearance into free_pages_prepare()\n\nSyzbot reported a bad page state problem caused by a page being freed\nusing free_page() still having a mlocked flag at free_pages_prepare()\nstage:\n\n  BUG: Bad page state in process syz.5.504  pfn:61f45\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45\n  flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff)\n  raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n  page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n  page_owner tracks the page as allocated\n  page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394\n   set_page_owner include/linux/page_owner.h:32 [inline]\n   post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537\n   prep_new_page mm/page_alloc.c:1545 [inline]\n   get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457\n   __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733\n   alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265\n   kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99\n   kvm_create_vm virt/kvm/kvm_main.c:1235 [inline]\n   kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline]\n   kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530\n   __do_compat_sys_ioctl fs/ioctl.c:1007 [inline]\n   __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950\n   do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n   __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386\n   do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411\n   entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n  page last free pid 8399 tgid 8399 stack trace:\n   reset_page_owner include/linux/page_owner.h:25 [inline]\n   free_pages_prepare mm/page_alloc.c:1108 [inline]\n   free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686\n   folios_put_refs+0x76c/0x860 mm/swap.c:1007\n   free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335\n   __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]\n   tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]\n   tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]\n   tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373\n   tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465\n   exit_mmap+0x496/0xc40 mm/mmap.c:1926\n   __mmput+0x115/0x390 kernel/fork.c:1348\n   exit_mm+0x220/0x310 kernel/exit.c:571\n   do_exit+0x9b2/0x28e0 kernel/exit.c:926\n   do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n   __do_sys_exit_group kernel/exit.c:1099 [inline]\n   __se_sys_exit_group kernel/exit.c:1097 [inline]\n   __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097\n   x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  Call Trace:\n   <TASK>\n   __dump_stack lib/dump_stack.c:94 [inline]\n   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n   bad_page+0x176/0x1d0 mm/page_alloc.c:501\n   free_page_is_bad mm/page_alloc.c:918 [inline]\n   free_pages_prepare mm/page_alloc.c:1100 [inline]\n   free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638\n   kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline]\n   kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386\n   kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143\n   __fput+0x23f/0x880 fs/file_table.c:431\n   task_work_run+0x24f/0x310 kernel/task_work.c:239\n   exit_task_work include/linux/task_work.h:43 [inline]\n   do_exit+0xa2f/0x28e0 kernel/exit.c:939\n   do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n   __do_sys_exit_group kernel/exit.c:1099 [in\n---truncated---"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/page_alloc.c","mm/swap.c"],"versions":[{"version":"b109b87050df5438ee745b2bddfa3587970025bb","lessThan":"2521664c1fc0fcea825ef0b4d8e2dfb622bc0f9a","status":"affected","versionType":"git"},{"version":"b109b87050df5438ee745b2bddfa3587970025bb","lessThan":"81ad32b87eb91b627a4b0d8760434e5fac4b993a","status":"affected","versionType":"git"},{"version":"b109b87050df5438ee745b2bddfa3587970025bb","lessThan":"7873d11911cd1d21e25c354eb130d8c3b5cb3ca5","status":"affected","versionType":"git"},{"version":"b109b87050df5438ee745b2bddfa3587970025bb","lessThan":"66edc3a5894c74f8887c8af23b97593a0dd0df4d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/page_alloc.c","mm/swap.c"],"versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"6.1.120","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.66","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.11.10","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.11.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2521664c1fc0fcea825ef0b4d8e2dfb622bc0f9a"},{"url":"https://git.kernel.org/stable/c/81ad32b87eb91b627a4b0d8760434e5fac4b993a"},{"url":"https://git.kernel.org/stable/c/7873d11911cd1d21e25c354eb130d8c3b5cb3ca5"},{"url":"https://git.kernel.org/stable/c/66edc3a5894c74f8887c8af23b97593a0dd0df4d"}],"title":"mm: page_alloc: move mlocked flag clearance into free_pages_prepare()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-53105","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T20:10:57.814885Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-401","description":"CWE-401 Missing Release of Memory after Effective Lifetime"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T20:17:12.036Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:45:56.207Z"}}]}}