{
  "cveId": "CVE-2024-40915",
  "url": "https://patchblox.com/security/cve/CVE-2024-40915",
  "summary": "CVE-2024-40915 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-40915, released July 12, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  riscv: rewrite __kernel_map_pages() to fix sleep...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context  __kernel_map_pages() is a debug function which clears the valid bit in page table entry for deallocated pages to detect illegal memory accesses to freed pages.  This function set/clear the valid bit using __set_memory(). __set_memory() acquires init_mm\u0027s semaphore, and this operation may sleep. This is problematic, because  __kernel_map_pages() can be called in atomic context, and thus is illegal to sleep. An example warning that this causes:  BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1578 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd preempt_count: 2, expected: 0 CPU: 0 PID: 2 Comm: kthreadd Not tainted 6.9.0-g1d4c6d784ef6 #37 Hardware name: riscv-virtio,qemu (DT) Call Trace: [\u003Cffffffff800060dc\u003E] dump_backtrace\u002B0x1c/0x24 [\u003Cffffffff8091ef6e\u003E] show_stack\u002B0x2c/0x38 [\u003Cffffffff8092baf8\u003E] dump_stack_lvl\u002B0x5a/0x72 [\u003Cffffffff8092bb24\u003E] dump_stack\u002B0x14/0x1c [\u003Cffffffff8003b7ac\u003E] __might_resched\u002B0x104/0x10e [\u003Cffffffff8003b7f4\u003E] __might_sleep\u002B0x3e/0x62 [\u003Cffffffff8093276a\u003E] down_write\u002B0x20/0x72 [\u003Cffffffff8000cf00\u003E] __set_memory\u002B0x82/0x2fa [\u003Cffffffff8000d324\u003E] __kernel_map_pages\u002B0x5a/0xd4 [\u003Cffffffff80196cca\u003E] __alloc_pages_bulk\u002B0x3b2/0x43a [\u003Cffffffff8018ee82\u003E] __vmalloc_node_range\u002B0x196/0x6ba [\u003Cffffffff80011904\u003E] copy_process\u002B0x72c/0x17ec [\u003Cffffffff80012ab4\u003E] kernel_clone\u002B0x60/0x2fe [\u003Cffffffff80012f62\u003E] kernel_thread\u002B0x82/0xa0 [\u003Cffffffff8003552c\u003E] kthreadd\u002B0x14a/0x1be [\u003Cffffffff809357de\u003E] ret_from_fork\u002B0xe/0x1c  Rewrite this function with apply_to_existing_page_range(). It is fine to not have any locking, because __kernel_map_pages() works with pages being allocated/deallocated and those pages are not changed by anyone else in the meantime.",
  "published": "2024-07-12T13:15:14Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00209,
  "epssPercentile": 0.11165,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.99-1",
      "fix": "DEBIAN-CVE-2024-40915",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-40915",
      "released": "2024-07-12T13:15:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.9.7-1",
      "fix": "DEBIAN-CVE-2024-40915",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-40915",
      "released": "2024-07-12T13:15:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.9.7-1",
      "fix": "DEBIAN-CVE-2024-40915",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-40915",
      "released": "2024-07-12T13:15:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}