{"id":"DEBIAN-CVE-2024-53097","details":"In the Linux kernel, the following vulnerability has been resolved:  mm: krealloc: Fix MTE false alarm in __do_krealloc  This patch addresses an issue introduced by commit 1a83a716ec233 (\"mm: krealloc: consider spare memory for __GFP_ZERO\") which causes MTE (Memory Tagging Extension) to falsely report a slab-out-of-bounds error.  The problem occurs when zeroing out spare memory in __do_krealloc. The original code only considered software-based KASAN and did not account for MTE. It does not reset the KASAN tag before calling memset, leading to a mismatch between the pointer tag and the memory tag, resulting in a false positive.  Example of the error: ================================================================== swapper/0: BUG: KASAN: slab-out-of-bounds in __memset+0x84/0x188 swapper/0: Write at addr f4ffff8005f0fdf0 by task swapper/0/1 swapper/0: Pointer tag: [f4], memory tag: [fe] swapper/0: swapper/0: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12. swapper/0: Hardware name: MT6991(ENG) (DT) swapper/0: Call trace: swapper/0:  dump_backtrace+0xfc/0x17c swapper/0:  show_stack+0x18/0x28 swapper/0:  dump_stack_lvl+0x40/0xa0 swapper/0:  print_report+0x1b8/0x71c swapper/0:  kasan_report+0xec/0x14c swapper/0:  __do_kernel_fault+0x60/0x29c swapper/0:  do_bad_area+0x30/0xdc swapper/0:  do_tag_check_fault+0x20/0x34 swapper/0:  do_mem_abort+0x58/0x104 swapper/0:  el1_abort+0x3c/0x5c swapper/0:  el1h_64_sync_handler+0x80/0xcc swapper/0:  el1h_64_sync+0x68/0x6c swapper/0:  __memset+0x84/0x188 swapper/0:  btf_populate_kfunc_set+0x280/0x3d8 swapper/0:  __register_btf_kfunc_id_set+0x43c/0x468 swapper/0:  register_btf_kfunc_id_set+0x48/0x60 swapper/0:  register_nf_nat_bpf+0x1c/0x40 swapper/0:  nf_nat_init+0xc0/0x128 swapper/0:  do_one_initcall+0x184/0x464 swapper/0:  do_initcall_level+0xdc/0x1b0 swapper/0:  do_initcalls+0x70/0xc0 swapper/0:  do_basic_setup+0x1c/0x28 swapper/0:  kernel_init_freeable+0x144/0x1b8 swapper/0:  kernel_init+0x20/0x1a8 swapper/0:  ret_from_fork+0x10/0x20 ==================================================================","modified":"2026-09-15T09:03:15.931007620Z","published":"2024-11-25T22:15:15.763Z","upstream":["CVE-2024-53097"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-53097"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.119-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53097.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.9-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53097.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.9-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53097.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}