Answer in brief
CVE-2024-57945 records a High severity (CVSS 7.8) vulnerability in riscv: mm: Fix the out of bound issue of vmemmap address. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8af1c121b0102041809bc137ec600d1865eaeedd <04350304428063da6a55a8a4597d409dc69148b2 || >=8310080799b40fd9f2a8b808c657269678c149af <92f08673d3f1893191323572f60e3c62f2e57c2f || >=a278d5c60f21aa15d540abb2f2da6e6d795c3e6e <a4a7ac3d266008018f05fae53060fcb331151a14 || >=a11dd49dcb9376776193e15641f84fcc1e5980c9 <d2bd51954ac8377c2f1eb1813e694788998add66 || >=a11dd49dcb9376776193e15641f84fcc1e5980c9 <f754f27e98f88428aaf6be6e00f5cbce97f62d4b || 5941a90c55d3bfba732b32208d58d997600b44ef || 2a1728c15ec4f45ed9248ae22f626541c179bfbe || >=5.10.212 <5.10.258 || >=6.1.81 <6.1.140 || >=6.6.21 <6.6.72 || >=5.15.151 <5.16 || >=6.7.9 <6.8 | 04350304428063da6a55a8a4597d409dc69148b2, 92f08673d3f1893191323572f60e3c62f2e57c2f, a4a7ac3d266008018f05fae53060fcb331151a14, d2bd51954ac8377c2f1eb1813e694788998add66, f754f27e98f88428aaf6be6e00f5cbce97f62d4b, 5.10.258, 6.1.140, 6.6.72, 5.16, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Jan 21, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the out of bound issue of vmemmap address In sparse vmemmap model, the virtual address of vmemmap is calculated as: ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)). And the struct page's va can be calculated with an offset: (vmemmap + (pfn)). However, when initializing struct pages, kernel actually starts from the first page from the same section that phys_ram_base belongs to. If the first page's physical address is not (phys_ram_base >> PAGE_SHIFT), then we get an va below VMEMMAP_START when calculating va for it's struct page. For example, if phys_ram_base starts from 0x82000000 with pfn 0x82000, the first page in the same section is actually pfn 0x80000. During init_unavailable_range(), we will initialize struct page for pfn 0x80000 with virtual address ((struct page *)VMEMMAP_START - 0x2000), which is below VMEMMAP_START as well as PCI_IO_END. This commit fixes this bug by introducing a new variable 'vmemmap_start_pfn' which is aligned with memory section size and using it to calculate vmemmap address instead of phys_ram_base.
Quoted source text, attributed separately from HOL analysis.