{"id":"DEBIAN-CVE-2024-39474","details":"In the Linux kernel, the following vulnerability has been resolved:  mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL  commit a421ef303008 (\"mm: allow !GFP_KERNEL allocations for kvmalloc\") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb (\"vmalloc: back off when the current task is OOM-killed\").  A possible scenario is as follows:  process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)     __vmalloc_area_node()         vm_area_alloc_pages() \t\t--\u003e oom-killer send SIGKILL to process-a         if (fatal_signal_pending(current)) break; --\u003e return NULL;  To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set.  This issue occurred during OPLUS KASAN TEST. Below is part of the log -\u003e oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198  [65731.259685] [T32454] Call trace: [65731.259698] [T32454]  dump_backtrace+0xf4/0x118 [65731.259734] [T32454]  show_stack+0x18/0x24 [65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c [65731.259781] [T32454]  dump_stack+0x18/0x38 [65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454]  notify_die+0x114/0x198 [65731.260073] [T32454]  die+0xf4/0x5b4 [65731.260098] [T32454]  die_kernel_fault+0x80/0x98 [65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454]  do_bad_area+0x68/0x148 [65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454]  el1_abort+0x3c/0x5c [65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454]  el1h_64_sync+0x68/0x6c  [65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258 --\u003e be-\u003edecompressed_pages = kvcalloc(be-\u003enr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); \tkernel panic by NULL pointer dereference. \terofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454]  read_pages+0x170/0xadc [65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454]  __do_fault+0xd0/0x33c [65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454]  el0_da+0x44/0x94 [65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454]  el0t_64_sync+0x198/0x19c","modified":"2026-09-15T09:03:09.366140392Z","published":"2024-07-05T07:15:10.190Z","upstream":["CVE-2024-39474"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-39474"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.99-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-39474.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-39474.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-39474.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}