Linux kernel mm/migrate: NULL dereference panic when memory offlining dumps a page under migration

Impact

During page migration the kernel stashed an anon_vma pointer in the target page's ->mapping field without setting PAGE_MAPPING_ANON. If another thread offlined that memory block at the same time, it dumped the page, page_mapping() returned what looked like a file mapping, and dump_mapping() dereferenced garbage - a hard kernel panic, reproduced with stress-ng. The fix moves the anon_vma pointer into page->private so PFN walkers (memory hotplug, compaction) can no longer be misled. On a GPU node this is a whole-host crash: every tenant pod and every in-flight training job on that node dies, and the node comes back only after a reboot. Triggering it needs concurrent memory offlining, which is an operator action, so this is a stability risk for fleets that use memory hotplug or balloon-style offlining rather than a tenant-reachable attack.

Who can reach it

Local: requires a privileged action that offlines a memory block (memory hotplug / device_offline) racing against ongoing page migration. Unprivileged tenants cannot initiate memory offlining.

What to do

Update to a stable kernel containing the fix for your series (commits in the record), which means draining the node and rebooting. Until then, avoid memory-block offlining on nodes carrying live workloads.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2023-52632 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel SUNRPC: kernel memory leak on error path when importing a krb5 GSS security contextCVE-2023-52653 · Linux kernel SUNRPC GSS-API krb5 context import (gss_import_v2_context)Medium
• Linux kernel BPF verifier: stack bound arithmetic done in 32 bits could overflowCVE-2023-52676 · Linux kernel BPF verifier (stack bounds arithmetic in kernel/bpf/verifier.c)Medium
• Linux kernel (net/tls): Sendfile() on a kTLS socket whose plaintext and ciphertext buffers are both empty drives theCVE-2023-52767 · Linux kernel (net/tls)Medium
• Linux cpufreq/amd-pstate-ut - kernel panic when loading the unit-test driver: Loading the amd-pstate unit-test moduleCVE-2023-53563 · Linux cpufreq/amd-pstate-ut - kernel panic when loading the unit-test driverMedium
• Linux kernel (net/xfrm): Structure padding in the xfrm algorithm and encapsulation templates was copied to userspaceCVE-2023-53684 · Linux kernel (net/xfrm)Medium