Linux kernel x86/mm: identity maps built from 1 GB pages cover unrequested reserved memory

Impact

ident_pud_init mapped a full 1 GB page even for a 4 KB request, so identity maps built during kexec and similar transitions covered large address ranges nobody asked for, including BIOS-reserved regions. Processor speculation into those reserved regions halts the system on SGI UV hardware. The fix falls back to 2 MB pages when only part of a 1 GB region is requested. The exposure is availability on affected platforms rather than a privilege boundary: there is no tenant-reachable path described here, and the trigger is kernel map construction, not a syscall an attacker drives. Operators should care mainly if they run UV-class systems or rely on kexec for fast node recycling, where an unexpected halt turns a planned reboot into a hardware-attention event.

Who can reach it

Local, and in practice triggered by kernel identity-map construction such as kexec rather than by an attacker-supplied input. Not reachable over the network; no tenant path is described in the record.

What to do

Pick up the stable kernel carrying commit d113f9723f2b (or your distribution's backport) and reboot each node - drain first on a GPU host. There is no runtime mitigation; the mapping decision happens in the kernel. If you do not run UV-class hardware, treat this as normal kernel hygiene rather than an out-of-cycle window.

References

Related entries

• Linux kernel (net/xfrm): Dumping SAs over xfrm netlink copies algorithm structures that were never fully initializedCVE-2024-50110 · Linux kernel (net/xfrm)Medium
• Linux kernel (drivers/gpu/drm/xe): Passing a sync object that fails fence lookup makes the exec ioctl return toCVE-2024-53086 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Every exec ioctl that bails on an input-validation error leaves an exec-queueCVE-2024-53087 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel sockmap: vsock or AF_UNIX socket in a sockmap faults in tls_sw_ctx_rxCVE-2024-53091 · Linux kernel sockmap/kTLS (tls_sw_has_ctx_tx/rx assumes an inet_connection_sock)Medium
• Linux kernel RDMA/siw: slab pages passed to MSG_SPLICE_PAGES trip a skb_splice_from_iter warningCVE-2024-53094 · Linux kernel RDMA/siw (software iWARP transmit path, MSG_SPLICE_PAGES)Medium
• Linux kernel io_uring: unchecked user address overflow in io_pin_pages during ring setupCVE-2024-53187 · Linux kernel io_uring (io_pin_pages address + size overflow)Medium