In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]mm/page_alloc: fix race condition in unaccepted memory handling[EOL][EOL]The page allocator tracks the number of zones that have unaccepted memory[EOL]using static_branch_enc/dec() and uses that static branch in hot paths to[EOL]determine if it needs to deal with unaccepted memory.[EOL][EOL]Borislav and Thomas pointed out that the tracking is racy: operations on[EOL]static_branch are not serialized against adding/removing unaccepted pages[EOL]to/from the zone.[EOL][EOL]Sanity checks inside static_branch machinery detects it:[EOL][EOL]WARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0[EOL][EOL]The comment around the WARN() explains the problem:[EOL][EOL]\t/*[EOL]\t * Warn about the '-1' case though; since that means a[EOL]\t * decrement is concurrent with a first (0->1) increment. IOW[EOL]\t * people are trying to disable something that wasn't yet fully[EOL]\t * enabled. This suggests an ordering problem on the user side.[EOL]\t */[EOL][EOL]The effect of this static_branch optimization is only visible on[EOL]microbenchmark.[EOL][EOL]Instead of adding more complexity around it, remove it altogether. CREATE(Triage):(User=lchen-cn) [CVE-2025-38008 (https://nvd.nist.gov/vuln/detail/CVE-2025-38008)
