{"id":"CVE-2021-46988","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: release page in error path to avoid BUG_ON\n\nConsider the following sequence of events:\n\n1. Userspace issues a UFFD ioctl, which ends up calling into\n   shmem_mfill_atomic_pte(). We successfully account the blocks, we\n   shmem_alloc_page(), but then the copy_from_user() fails. We return\n   -ENOENT. We don't release the page we allocated.\n2. Our caller detects this error code, tries the copy_from_user() after\n   dropping the mmap_lock, and retries, calling back into\n   shmem_mfill_atomic_pte().\n3. Meanwhile, let's say another process filled up the tmpfs being used.\n4. So shmem_mfill_atomic_pte() fails to account blocks this time, and\n   immediately returns - without releasing the page.\n\nThis triggers a BUG_ON in our caller, which asserts that the page\nshould always be consumed, unless -ENOENT is returned.\n\nTo fix this, detect if we have such a \"dangling\" page when accounting\nfails, and if so, release it before returning.","modified":"2026-03-13T05:20:26.783160Z","published":"2024-02-28T09:15:37.640Z","related":["SUSE-SU-2024:1454-1","SUSE-SU-2024:1465-1","SUSE-SU-2024:1489-1","SUSE-SU-2024:1643-1","SUSE-SU-2024:1646-1","SUSE-SU-2024:1870-1"],"references":[{"type":"FIX","url":"https://git.kernel.org/stable/c/ad53127973034c63b5348715a1043d0e80ceb330"},{"type":"FIX","url":"https://git.kernel.org/stable/c/b3f1731c6d7fbc1ebe3ed8eff6d6bec56d76ff43"},{"type":"FIX","url":"https://git.kernel.org/stable/c/07c9b834c97d0fa3402fb7f3f3b32df370a6ff1f"},{"type":"FIX","url":"https://git.kernel.org/stable/c/140cfd9980124aecb6c03ef2e69c72d0548744de"},{"type":"FIX","url":"https://git.kernel.org/stable/c/2d59a0ed8b26b8f3638d8afc31f839e27759f1f6"},{"type":"FIX","url":"https://git.kernel.org/stable/c/319116227e52d49eee671f0aa278bac89b3c1b69"},{"type":"FIX","url":"https://git.kernel.org/stable/c/7ed9d238c7dbb1fdb63ad96a6184985151b0171c"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"4.11"},{"fixed":"4.14.233"}]},{"events":[{"introduced":"4.15"},{"fixed":"4.19.191"}]},{"events":[{"introduced":"4.20"},{"fixed":"5.4.120"}]},{"events":[{"introduced":"5.5"},{"fixed":"5.10.38"}]},{"events":[{"introduced":"5.11"},{"fixed":"5.11.22"}]},{"events":[{"introduced":"5.12"},{"fixed":"5.12.5"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc1"}]}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-46988.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}