CVE-2024-26989 in Linux
Summary
by MITRE • 05/01/2024
In the Linux kernel, the following vulnerability has been resolved:
arm64: hibernate: Fix level3 translation fault in swsusp_save()
On arm64 machines, swsusp_save() faults if it attempts to access MEMBLOCK_NOMAP memory ranges. This can be reproduced in QEMU using UEFI when booting with rodata=off debug_pagealloc=off and CONFIG_KFENCE=n:
Unable to handle kernel paging request at virtual address ffffff8000000000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000eeb0b000 [ffffff8000000000] pgd=180000217fff9803, p4d=180000217fff9803, pud=180000217fff9803, pmd=180000217fff8803, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in: xt_multiport ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter rfkill at803x snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg dwmac_generic stmmac_platform snd_hda_codec stmmac joydev pcs_xpcs snd_hda_core phylink ppdev lp parport ramoops reed_solomon ip_tables x_tables nls_iso8859_1 vfat multipath linear amdgpu amdxcp drm_exec gpu_sched drm_buddy hid_generic usbhid hid radeon video drm_suballoc_helper drm_ttm_helper ttm i2c_algo_bit drm_display_helper cec drm_kms_helper drm CPU: 0 PID: 3663 Comm: systemd-sleep Not tainted 6.6.2+ #76 Source Version: 4e22ed63a0a48e7a7cff9b98b7806d8d4add7dc0 Hardware name: Greatwall GW-XXXXXX-XXX/GW-XXXXXX-XXX, BIOS KunLun BIOS V4.0 01/19/2021 pstate: 600003c5 (nZCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : swsusp_save+0x280/0x538 lr : swsusp_save+0x280/0x538 sp : ffffffa034a3fa40 x29: ffffffa034a3fa40 x28: ffffff8000001000 x27: 0000000000000000 x26: ffffff8001400000 x25: ffffffc08113e248 x24: 0000000000000000 x23: 0000000000080000 x22: ffffffc08113e280 x21: 00000000000c69f2 x20: ffffff8000000000 x19: ffffffc081ae2500 x18: 0000000000000000 x17: 6666662074736420 x16: 3030303030303030 x15: 3038666666666666 x14: 0000000000000b69 x13: ffffff9f89088530 x12: 00000000ffffffea x11: 00000000ffff7fff x10: 00000000ffff7fff x9 : ffffffc08193f0d0 x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 0000000000000001 x5 : ffffffa0fff09dc8 x4 : 0000000000000000 x3 : 0000000000000027 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000004e Call trace: swsusp_save+0x280/0x538 swsusp_arch_suspend+0x148/0x190 hibernation_snapshot+0x240/0x39c hibernate+0xc4/0x378 state_store+0xf0/0x10c kobj_attr_store+0x14/0x24
The reason is swsusp_save() -> copy_data_pages() -> page_is_saveable() -> kernel_page_present() assuming that a page is always present when can_set_direct_map() is false (all of rodata_full, debug_pagealloc_enabled() and arm64_kfence_can_set_direct_map() false), irrespective of the MEMBLOCK_NOMAP ranges. Such MEMBLOCK_NOMAP regions should not be saved during hibernation.
This problem was introduced by changes to the pfn_valid() logic in commit a7d9f306ba70 ("arm64: drop pfn_valid_within() and simplify pfn_valid()").
Similar to other architectures, drop the !can_set_direct_map() check in kernel_page_present() so that page_is_savable() skips such pages.
[[email protected]: rework commit message]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/06/2026
The vulnerability CVE-2024-26989 affects the Linux kernel on arm64 architectures and relates to an issue in the hibernation mechanism. Specifically, the swsusp_save() function fails when attempting to access memory ranges marked as MEMBLOCK_NOMAP during the hibernation process. This leads to a data abort exception with a level 3 translation fault, which occurs when the kernel tries to access virtual address ffffff8000000000. The error manifests under specific debug configurations such as rodata=off, debug_pagealloc=off, and with CONFIG_KFENCE disabled, particularly within QEMU environments using UEFI firmware. The root cause lies in the kernel_page_present() function's assumption that all pages are present even when can_set_direct_map() returns false, which is incorrect for MEMBLOCK_NOMAP regions that should not be included in hibernation snapshots.
This flaw stems from changes in pfn_valid() logic introduced in commit a7d9f306ba70, which altered how the kernel determines page validity on arm64 systems. The issue is consistent with patterns observed in other CPU architectures where similar checks were previously handled correctly. The problem is particularly significant because it affects the core hibernation functionality, potentially leading to system crashes or incomplete hibernation states when the kernel attempts to save memory contents that include non-mappable regions. The technical execution involves a cascade of function calls from swsusp_save() through copy_data_pages() to page_is_saveable() and ultimately kernel_page_present(), where the faulty logic fails to properly identify MEMBLOCK_NOMAP pages as unsavable. This vulnerability aligns with CWE-125, which describes out-of-bounds read conditions, and could be exploited through malicious hibernation requests or system misconfigurations that trigger the problematic code path.
The operational impact of this vulnerability is severe as it can cause system instability during hibernation operations, particularly in debug or development environments where the affected kernel parameters are enabled. Systems using UEFI firmware in QEMU virtualized environments are especially vulnerable, though the issue could potentially affect physical arm64 hardware under similar conditions. The error results in kernel oops and system crashes, effectively preventing successful hibernation and potentially leading to data loss or system downtime. Mitigation strategies should focus on applying the kernel patch that removes the faulty !can_set_direct_map() check from kernel_page_present(), thereby allowing page_is_saveable() to correctly identify and skip MEMBLOCK_NOMAP regions during hibernation. Organizations should also consider avoiding the problematic kernel boot parameters in production environments and ensure that hibernation features are properly tested in their specific configurations. This vulnerability demonstrates the importance of careful memory management and virtual address translation handling in kernel space, particularly in architectures like arm64 where memory mapping complexity increases due to different memory types and access controls. The fix follows established patterns used in other architectures and maintains consistency with kernel security practices by ensuring that only valid, mappable memory regions are included in hibernation snapshots, preventing access to memory that cannot be properly mapped or restored.