Linux kernel mm: snapshot_page() reads a non-existent tail page for order-1 folios and oopses the host

Impact

snapshot_page() guarded its read of __page_2 with nr_pages > 1 instead of nr_pages > 2, so an order-1 folio sitting at the end of a vmemmap section makes the kernel dereference struct-page memory that was never mapped. The reported trigger was a DLPAR memory hot-remove on a 22 TB ppc64le LPAR, where the page isolation path oopsed against an adjacent absent section. This is a host kernel crash, not a privilege boundary break - the record shows no path to code execution. On a GPU node the consequence is the expensive one: an oops in the memory-management path takes the node and every tenant workload pinned to its GPUs down at once, and recovery is a reboot rather than a service restart.

Who can reach it

Local, and only from code that can reach the page-snapshot path with an order-1 folio adjacent to a vmemmap hole; the record scores it as requiring low privileges. The only concretely documented trigger is memory hot-remove on a machine with unmapped vmemmap sections. Whether an unprivileged tenant can reach it on a conventional x86_64 GPU node without memory hotplug is not established by the record.

What to do

Update to a stable kernel carrying the fix (commits 7441d634, 9668ffe0, c6493245) and reboot the node. No fixed release numbers are given in the record - check the commit against your distribution's kernel changelog. Where memory hot-remove is what triggers it, holding off on DLPAR/hotplug operations avoids the documented path until the reboot window arrives.

References

Related entries

• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh
• Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationCVE-2021-22600 · Linux kernel (af_packet)High
• Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationCVE-2021-4204 · Linux kernel (eBPF)High
• Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runCVE-2022-0492 · Linux kernel (cgroups v1)High
• Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootCVE-2022-2602 · Linux kernel (io_uring)High
• Linux kernel (OverlayFS/FUSE): OverlayFS copies setuid files from a nosuid FUSE mountCVE-2023-0386 · Linux kernel (OverlayFS/FUSE)High