CVE-2022-49828

hugetlbfs: don't delete error page from pagecache

published May 1, 2025

CVSS
—
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

hugetlbfs: don't delete error page from pagecache

This change is very similar to the change that was made for shmem [1], and

it solves the same problem but for HugeTLBFS instead.

Currently, when poison is found in a HugeTLB page, the page is removed

from the page cache. That means that attempting to map or read that

hugepage in the future will result in a new hugepage being allocated

instead of notifying the user that the page was poisoned. As [1] states,

this is effectively memory corruption.

The fix is to leave the page in the page cache. If the user attempts to

use a poisoned HugeTLB page with a syscall, the syscall will fail with

EIO, the same error code that shmem uses. For attempts to map the page,

the thread will get a BUS_MCEERR_AR SIGBUS.

[1]: commit a76054266661 ("mm: shmem: don't truncate page if memory failure happens")

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.2th percentile
Published
2025-05-01T14:09Z
EPSS history
Timeline
  • 01 MAY 14:09Z
    hugetlbfs: don't delete error page from pagecache
    cvelistv5