Linux kernel hugetlb: use-after-free of the VMA lock when a userfaultfd handler races an mmap

Impact

A local process can race hugetlb fault handling against mmap/munmap so that the kernel re-acquires a VMA lock belonging to a VMA that has already been torn down, giving a use-after-free with the usual path to local privilege escalation or a kernel panic. This matters on GPU nodes because huge pages are standard practice for large training and inference jobs, and userfaultfd is reachable by unprivileged processes in default configurations, so the trigger sits inside any tenant container that is not explicitly restricted. On a shared node the realistic outcome is either a crash that takes every co-tenant job on the host with it, or a container escape to host root with access to every GPU on the box.

Who can reach it

Local, authenticated: any user or container process that can call mmap with hugetlb pages and register a userfaultfd region. No special capability is named in the record; seccomp profiles that block userfaultfd remove the trigger.

What to do

Pick up the fixed stable kernel for your series (commits linked in the record) and reboot. That means draining each GPU node and rebooting it - no hot patch is available from the upstream fix, and running jobs will not survive. Where a reboot cycle cannot be scheduled quickly, blocking userfaultfd for untrusted workloads (seccomp, or the unprivileged_userfaultfd sysctl where available) removes the demonstrated trigger.

References

Related entries

• Linux kernel BPF verifier: callback reference accounting lets a program leak or double-release kernel referencesCVE-2022-50650 · Linux kernel BPF verifier (reference state tracking for synchronous callbacks)High
• Linux kernel (drivers/nvme/host): The PRP list mempool is sized in the wrong units, so a large I/O that needs two PRPCVE-2022-50756 · Linux kernel (drivers/nvme/host)High
• Linux kernel (netfilter): Integer overflow in nft_payload_copy_vlan - stack leak plus local privilege escalationCVE-2023-0179 · Linux kernel (netfilter)High
• Linux kernel (ALSA): Use-after-free in snd_ctl_elem_read - local privilege escalationCVE-2023-0266 · Linux kernel (ALSA)High
• Oracle VirtualBox: Core component flaw allowing a low-privileged guest user to take over the host VirtualBoxCVE-2023-21987 · Oracle VirtualBoxHigh
• Linux kernel (io_uring): io_uring fixed-buffer registration gives out-of-bounds access to physical memoryCVE-2023-2598 · Linux kernel (io_uring)High