Linux kernel x86/mm: identity maps built from 1 GB pages cover unrequested reserved memory

CVSS 5.5CVE-2024-50017Kernel, userspace & hypervisorcurated

Impact

ident_pud_init mapped a full 1 GB page even for a 4 KB request, so identity maps built during kexec and similar transitions covered large address ranges nobody asked for, including BIOS-reserved regions. Processor speculation into those reserved regions halts the system on SGI UV hardware. The fix falls back to 2 MB pages when only part of a 1 GB region is requested. The exposure is availability on affected platforms rather than a privilege boundary: there is no tenant-reachable path described here, and the trigger is kernel map construction, not a syscall an attacker drives. Operators should care mainly if they run UV-class systems or rely on kexec for fast node recycling, where an unexpected halt turns a planned reboot into a hardware-attention event.

Who can reach it

Local, and in practice triggered by kernel identity-map construction such as kexec rather than by an attacker-supplied input. Not reachable over the network; no tenant path is described in the record.

What to do

Pick up the stable kernel carrying commit d113f9723f2b (or your distribution's backport) and reboot each node - drain first on a GPU host. There is no runtime mitigation; the mapping decision happens in the kernel. If you do not run UV-class hardware, treat this as normal kernel hygiene rather than an out-of-cycle window.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-50017 https://git.kernel.org/stable/c/d113f9723f2bfd9c6feeb899b8ddbee6b8a6e01f https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.