# CVE-2024-42317: mm/huge_memory: avoid PMD-size page cache if needed

CVE-2024-42317 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-42317, released August 17, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-42317
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 17, 2024
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-42317

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm/huge_memory: avoid PMD-size page cache if needed  xarray can't support arbitrary page cache size.  the largest and supported page cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71 ("mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray").  However, it's possible to have 512MB page cache in the huge memory's collapsing path on ARM64 system whose base page size is 64KB.  512MB page cache is breaking the limitation and a warning is raised when the xarray entry is split as shown in the following example.  [root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize KernelPageSize:       64 kB [root@dhcp-10-26-1-207 ~]# cat /tmp/test.c    : int main(int argc, char **argv) { 	const char *filename = TEST_XFS_FILENAME; 	int fd = 0; 	void *buf = (void *)-1, *p; 	int pgsize = getpagesize(); 	int ret = 0;  	if (pgsize != 0x10000) { 		fprintf(stdout, "System with 64KB base page size is required!\n"); 		return -EPERM; 	}  	system("echo 0 > /sys/devices/virtual/bdi/253:0/read_ahead_kb"); 	system("echo 1 > /proc/sys/vm/drop_caches");  	/* Open the xfs file */ 	fd = open(filename, O_RDONLY); 	assert(fd > 0);  	/* Create VMA */ 	buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0); 	assert(buf != (void *)-1); 	fprintf(stdout, "mapped buffer at 0x%p\n", buf);  	/* Populate VMA */ 	ret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE); 	assert(ret == 0); 	ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ); 	assert(ret == 0);  	/* Collapse VMA */ 	ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); 	assert(ret == 0); 	ret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE); 	if (ret) { 		fprintf(stdout, "Error %d to madvise(MADV_COLLAPSE)\n", errno); 		goto out; 	}  	/* Split xarray entry. Write permission is needed */ 	munmap(buf, TEST_MEM_SIZE); 	buf = (void *)-1; 	close(fd); 	fd = open(filename, O_RDWR); 	assert(fd > 0); 	fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,  		  TEST_MEM_SIZE - pgsize, pgsize); out: 	if (buf != (void *)-1) 		munmap(buf, TEST_MEM_SIZE); 	if (fd > 0) 		close(fd);  	return ret; }  [root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test [root@dhcp-10-26-1-207 ~]# /tmp/test  ------------[ cut here ]------------  WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128  Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib    \  nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct      \  nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4      \  ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse   \  xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net  \  sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio  CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9  Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024  pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)  pc : xas_split_alloc+0xf8/0x128  lr : split_huge_page_to_list_to_order+0x1c4/0x780  sp : ffff8000ac32f660  x29: ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0  x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d  x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000  x20: 0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000  x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000  x11: ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c  x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8  x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40  x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000  Call trace:   xas_split_alloc+0xf8/0x128   split_huge_page_to_list_to_order+0x1c4/0x780   truncate_inode_partial_folio+0xdc/0x160   truncate_inode_pages_range+0x1b4/0x4a8   truncate_pagecache_range+0x84/0xa ---truncated---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.10.3-1 | [DEBIAN-CVE-2024-42317](https://patchblox.com/security/data/fix/linux/debian-cve-2024-42317.md) | Aug 17, 2024 |
| Linux | linux Debian 14 | 6.10.3-1 | [DEBIAN-CVE-2024-42317](https://patchblox.com/security/data/fix/linux/debian-cve-2024-42317.md) | Aug 17, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.