CVE-2024-53113 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2024-53113?

CVE-2024-53113 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's memory allocation subsystem allows local attackers to cause a kernel panic (denial of service) when processes migrate between cpusets. This affects Linux systems with cpuset functionality enabled, potentially leading to system crashes.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's memory allocation subsystem allows local attackers to cause a kernel panic (denial of service) when processes migrate between cpusets. This affects Linux systems with cpuset functionality enabled, potentially leading to system crashes.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE; likely recent kernel versions before fixes were applied.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires cpuset functionality to be enabled (common in containerized environments). The vulnerability triggers during process migration between cpusets with specific memory allocation patterns.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to complete system crash and denial of service, requiring physical or remote console access to reboot.

🟠

Likely Case

System instability or crash when processes with specific memory allocation patterns migrate between cpusets, causing temporary denial of service.

🟢

If Mitigated

Minimal impact if cpuset functionality is disabled or systems are patched, with only specific process migration scenarios triggering the issue.

🌐 Internet-Facing: LOW - Requires local access to exploit; cannot be triggered remotely.

🏢 Internal Only: MEDIUM - Local attackers or misconfigured processes could trigger system crashes affecting availability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger process migration between cpusets with specific timing. The vulnerability was discovered through normal kernel development/testing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 31502374627ba9ec3e710dbd0bb00457cc6d2c19, 6addb2d9501ec866d7b3a3b4e665307c437e9be2, 8ce41b0f9d77cca074df25afd39b86e2ee3aa68e, 903d896448c2e50e8652aaba529a30d4d1eaa0e5, d0f16cec79774c3132df006cf771eddd89d08f58

Vendor Advisory: https://git.kernel.org/stable/c/31502374627ba9ec3e710dbd0bb00457cc6d2c19

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable cpuset functionality

linux

Prevents the vulnerability by disabling the cpuset feature that triggers the NULL pointer dereference during process migration.

echo 0 > /proc/sys/kernel/cpuset_enabled
Add 'cpuset=disable' to kernel boot parameters

Restrict process migration

linux

Limit process migration between cpusets to reduce likelihood of triggering the vulnerability.

Use cgroup/cpuset configuration to restrict process movement
Set cpuset.cpu_exclusive and cpuset.mem_exclusive to 1

🧯 If You Can't Patch

Monitor system logs for kernel panic/OOPS messages related to alloc_pages_bulk_noprof
Implement strict process isolation policies to minimize cpuset migrations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from kernel.org commits. Vulnerable if running unpatched kernel with cpuset enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: cat /proc/version | grep -E '(31502374627ba9ec3e710dbd0bb00457cc6d2c19|6addb2d9501ec866d7b3a3b4e665307c437e9be2|8ce41b0f9d77cca074df25afd39b86e2ee3aa68e|903d896448c2e50e8652aaba529a30d4d1eaa0e5|d0f16cec79774c3132df006cf771eddd89d08f58)'

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
OOPS messages mentioning alloc_pages_bulk_noprof
NULL pointer dereference in kernel logs
System crash/reboot events

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "alloc_pages_bulk_noprof" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2024-53113

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: December 2, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-53113, you might also want to check these: