CVE-2024-57884— mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm/vmscan组件存在free页面未计入问题。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< 66cd37660ec34ec444fe42f2277330ae4a36bb19 |
affected |
5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< d675fefbaec3815b3ae0af1bebd97f27df3a05c8 |
affected | ||
5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< 63eac98d6f0898229f515cb62fe4e4db2430e99c |
affected | ||
5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< bfb701192129803191c9cd6cdd1f82cd07f8de2c |
affected | ||
5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< 1ff2302e8aeac7f2eedb551d7a89617283b5c6b2 |
affected | ||
5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< 58d0d02dbc67438fc80223fdd7bbc49cf0733284 |
affected | ||
5a1c84b404a7176b8b36e2a0041b6f0adb3151a3< 6aaced5abd32e2a57cd94fd64f824514d0361da8 |
affected | ||
4.8 |
affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-57884
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
The task sometimes continues looping in throttle_direct_reclaim() because
allow_direct_reclaim(pgdat) keeps returning false.
#0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac
#1 [ffff80002cb6f900] __schedule at ffff800008abbd1c
#2 [ffff80002cb6f990] schedule at ffff800008abc50c
#3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550
#4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68
#5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660
#6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98
#7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8
#8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974
#9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4
At this point, the pgdat contains the following two zones:
NODE: 4 ZONE: 0 ADDR: ffff00817fffe540 NAME: "DMA32"
SIZE: 20480 MIN/LOW/HIGH: 11/28/45
VM_STAT:
NR_FREE_PAGES: 359
NR_ZONE_INACTIVE_ANON: 18813
NR_ZONE_ACTIVE_ANON: 0
NR_ZONE_INACTIVE_FILE: 50
NR_ZONE_ACTIVE_FILE: 0
NR_ZONE_UNEVICTABLE: 0
NR_ZONE_WRITE_PENDING: 0
NR_MLOCK: 0
NR_BOUNCE: 0
NR_ZSPAGES: 0
NR_FREE_CMA_PAGES: 0
NODE: 4 ZONE: 1 ADDR: ffff00817fffec00 NAME: "Normal"
SIZE: 8454144 PRESENT: 98304 MIN/LOW/HIGH: 68/166/264
VM_STAT:
NR_FREE_PAGES: 146
NR_ZONE_INACTIVE_ANON: 94668
NR_ZONE_ACTIVE_ANON: 3
NR_ZONE_INACTIVE_FILE: 735
NR_ZONE_ACTIVE_FILE: 78
NR_ZONE_UNEVICTABLE: 0
NR_ZONE_WRITE_PENDING: 0
NR_MLOCK: 0
NR_BOUNCE: 0
NR_ZSPAGES: 0
NR_FREE_CMA_PAGES: 0
In allow_direct_reclaim(), while processing ZONE_DMA32, the sum of
inactive/active file-backed pages calculated in zone_reclaimable_pages()
based on the result of zone_page_state_snapshot() is zero.
Additionally, since this system lacks swap, the calculation of inactive/
active anonymous pages is skipped.
crash> p nr_swap_pages
nr_swap_pages = $1937 = {
counter = 0
}
As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on to
the processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 having
free pages significantly exceeding the high watermark.
The problem is that the pgdat->kswapd_failures hasn't been incremented.
crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures
$1935 = 0x0
This is because the node deemed balanced. The node balancing logic in
balance_pgdat() evaluates all zones collectively. If one or more zones
(e.g., ZONE_DMA32) have enough free pages to meet their watermarks, the
entire node is deemed balanced. This causes balance_pgdat() to exit early
before incrementing the kswapd_failures, as it considers the overall
memory state acceptable, even though some zones (like ZONE_NORMAL) remain
under significant pressure.
The patch ensures that zone_reclaimable_pages() includes free pages
(NR_FREE_PAGES) in its calculation when no other reclaimable pages are
available (e.g., file-backed or anonymous pages). This change prevents
zones like ZONE_DMA32, which have sufficient free pages, from being
mistakenly deemed unreclaimable. By doing so, the patch ensures proper
node balancing, avoids masking pressure on other zones like ZONE_NORMAL,
and prevents infinite loops in throttle_direct_reclaim() caused by
allow_direct_reclaim(pgdat) repeatedly returning false.
The kernel hangs due to a task stuck in throttle_direct_reclaim(), caused
by a node being incorrectly deemed balanced despite pressure in certain
zones, such as ZONE_NORMAL. This issue arises from
zone_reclaimable_pages
---truncated---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm/vmscan组件存在free页面未计入问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-57884
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-57884
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-57884 (7)
Same Patch Batch · Linux · 2025-01-15 · 32 CVEs total
| CVE-2024-57882 | 9.8 CRITICAL | mptcp: fix TCP options overflow. |
| CVE-2024-36476 | 9.8 CRITICAL | RDMA/rtrs: Ensure 'ib_sge list' is accessible |
| CVE-2024-57802 | 9.4 CRITICAL | netrom: check buffer length before accessing it |
| CVE-2025-21629 | 8.2 HIGH | net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets |
| CVE-2024-57883 | 7.8 HIGH | mm: hugetlb: independent PMD page table shared count |
| CVE-2024-57857 | 7.8 HIGH | RDMA/siw: Remove direct link to net_device |
| CVE-2024-57801 | 7.8 HIGH | net/mlx5e: Skip restore TC rules for vport rep without loaded flag |
| CVE-2024-57795 | 7.8 HIGH | RDMA/rxe: Remove the direct link to net_device |
| CVE-2024-39282 | 7.8 HIGH | net: wwan: t7xx: Fix FSM command timeout issue |
| CVE-2024-57896 | 7.8 HIGH | btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount |
| CVE-2024-57893 | 7.8 HIGH | ALSA: seq: oss: Fix races at processing SysEx messages |
| CVE-2024-57887 | 7.8 HIGH | drm: adv7511: Fix use-after-free in adv7533_attach_dsi() |
| CVE-2024-57899 | 7.6 HIGH | wifi: mac80211: fix mbss changed flags corruption on 32 bit systems |
| CVE-2024-57902 | 7.3 HIGH | af_packet: fix vlan_get_tci() vs MSG_PEEK |
| CVE-2024-57901 | 7.3 HIGH | af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK |
| CVE-2024-57895 | 7.1 HIGH | ksmbd: set ATTR_CTIME flags when setting mtime |
| CVE-2024-57885 | mm/kmemleak: fix sleeping function called from invalid context at print message | |
| CVE-2024-57844 | drm/xe: Fix fault on fd close after unbind | |
| CVE-2024-57841 | net: fix memory leak in tcp_conn_request() | |
| CVE-2024-57886 | mm/damon/core: fix new damon_target objects leaks on damon_commit_targets() |
Showing top 20 of 32 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2024-57884
No comments yet