Loading vulnerability…
NULL pointer dereference in Linux kernel bulk page allocation
CVE-2024-53113 is a NULL pointer dereference in the Linux kernel memory-management function alloc_pages_bulk_noprof(). With cpuset support enabled, prepare_alloc_pages() can set the allocation nodemask to current->mems_allowed. Task migration between cpusets can modify this nodemask concurrently with first_zones_zonelist() traversal, leaving ac.preferred_zoneref referencing a NULL zone. Subsequent processing can find an allowable zone and call zonelist_node_idx(ac.preferred_zoneref), triggering the NULL pointer dereference and potentially disrupting system availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Triggering the allocation race causes a kernel NULL pointer dereference, potentially resulting in denial of service and disruption of workloads on the affected system. Specific confidentiality or integrity consequences are not established.
If you can’t patch tonight, do this now.
Until a fixed kernel can be deployed, reduce exposure by avoiding or restricting concurrent migration of allocation-intensive tasks between cpusets. Disabling cpuset use where operationally acceptable removes the described race precondition, but patching and rebooting remain the recommended resolution.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the NULL check for preferred_zoneref->zone in alloc_pages_bulk_noprof(), and reboot into the updated kernel. Fixed RHEL kernel releases include 5.14.0-70.124.1.el9_0 for RHEL 9.0, 5.14.0-284.103.1.el9_2 for RHEL 9.2, and 5.14.0-427.55.1.el9_4 for RHEL 9.4. Corresponding real-time fixes include 5.14.0-70.124.1.rt21.196.el9_0 and 5.14.0-284.103.1.rt14.388.el9_2. For affected Google Container-Optimized OS kernel packages, update to version 18613.75.89 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.