Executive brief
A vulnerability in the Linux kernel's memory management system can cause a system to become unresponsive (soft lockup) during Out-of-Memory (OOM) events. This occurs when the system attempts to manage a very large number of processes (e.g., tens of thousands) within a specific memory control group. An exploit could lead to a denial-of-service condition, impacting the availability of the server and any hosted applications.
Technical details
A soft lockup vulnerability exists in the Linux kernel's memcg OOM handler. The issue is caused by the 'mem_cgroup_scan_tasks' function and global OOM 'dump_tasks' loop failing to yield the CPU while traversing a very large number of tasks (e.g., 56,000+). This results in the CPU being held for an extended period (e.g., 23 seconds), triggering the watchdog timer. The fix introduces 'cond_resched()' and 'touch_softlockup_watchdog()' every 1000 iterations to ensure the kernel remains responsive. This is a local denial-of-service vulnerability requiring the ability to trigger OOM conditions or manage large task counts in a cgroup.
Affected products
- Linux Linux Kernel 3.6 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2024-12-24: other: Patch authored
- 2025-02-26: advisory: CVE received from kernel.org
- 2025-02-27: disclosed: Initial publication
- 2025-03-07: patched: NIST initial analysis and patch references added
References
- https://git.kernel.org/stable/c/0a09d56e1682c951046bf15542b3e9553046c9f6
- https://git.kernel.org/stable/c/110399858194c71f11afefad6e7be9e3876b284f
- https://git.kernel.org/stable/c/46576834291869457d4772bb7df72d7c2bb3d57f
- https://git.kernel.org/stable/c/72f2c0b7c152c2983ed51d48c3272cab4f34d965
- https://git.kernel.org/stable/c/972486d37169fe85035e81b8c5dff21f70df1173
- https://git.kernel.org/stable/c/a9042dbc1ed4bf25a5f5c699d10c3d676abf8ca2
- https://git.kernel.org/stable/c/ade81479c7dda1ce3eedb215c78bc615bbd04f06