CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the handling of compound folios during memory migration, specifically within the `migrate_device_range()` and `migrate_device_pfns()` functions. This flaw can lead to out-of-bounds writes, potentially causing data corruption or system instability if the compound folio exceeds the provided PFN array size. Organizations utilizing Linux systems, particularly those employing memory migration features, should prioritize patching this vulnerability to mitigate risks associated with memory management errors.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: avoid out-of-bounds writes for compound folios migrate_device_range() and migrate_device_pfns() clear the entries following a compound folio so that the PFN arrays retain their page-granular representation. If a compound folio extends beyond the end of the caller-provided range, the loops clear all following folio entries without limiting them to the number of slots remaining in the npages-sized array, causing an out-of-bounds write. Do not proceed with a compound folio if its page-granular representation does not fit entirely in the remaining PFN array. If this happens, drop any reference and lock acquired for the folio, clear the remaining entries, and stop collecting. Observed with a KASAN x86 QEMU kernel using the HMM migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after migrating an anonymous huge page to device memory exercises: dmirror_fops_release() -> dmirror_device_evict_chunk() -> migrate_device_range()