CVE-2024-45022 mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses Two Vulnerabilities in Memory Management Microsoft has published information regarding two CVEs affecting memory management in the Linux kernel. CVE-2024-45022, published on September 11, 2024, addresses issues with page mapping in vm_area_alloc_pages(). CVE-2024-39474, published on July 5, 2024, fixes a potential null return in vmalloc when called with __GFP_NOFAIL. 2 sources 41