{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.190Z", "datePublished": "2024-04-17T15:59:22.597Z", "dateUpdated": "2026-08-05T11:28:15.941Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:15.941Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable allocator is reached only through DRM ioctls on a local device node (`/dev/dri/renderD128` or the primary node's dumb-buffer ioctl); there is no network-facing path to drm_buddy. Exploitation requires local code execution on the machine.\nAC:L - The attacker fully controls the inputs that drive the bug — allocation size and VRAM fragmentation — via repeated GEM create/destroy and CS submissions, so steering `__alloc_contig_try_harder()` to a free block whose RHS range overruns `mm->size` (or whose LHS offset underflows) is deterministic grooming, not a race or a condition outside their control.\nPR:L - An unprivileged local user with render-node access can trigger it; on typical desktop distros `/dev/dri/renderD128` is world-accessible, and GPU-accelerated containers, Android apps and ChromeOS sandboxes are granted it. `AMDGPU_GEM_CREATE`, `AMDGPU_CS`, `AMDGPU_GEM_VA` and `DRM_IOCTL_MODE_CREATE_DUMB` require no capability.\nUI:N - The attacker performs the allocations from their own process and consumes the resulting undersized buffer object themselves; no action by any other user is needed.\nS:U - The mis-sized allocation, the type-confused block, and the resulting VRAM accesses all remain under the kernel's own security authority — this is standard in-kernel memory corruption, not a VM escape or IOMMU boundary bypass.\nC:H - The buffer's tail is backed by VRAM belonging to other GPU clients, the scanout framebuffer, or kernel BOs, and the cursor overrun yields an attacker-influenced out-of-bounds VRAM offset; the attacker reads that memory via GPU shaders, CPU mmap of the BO, or dma-buf export — the reported \"display corruption\" is other buffers' contents being surfaced.\nI:H - The same aliased and out-of-bounds VRAM is writable through the attacker's GPU commands and CPU mappings, corrupting other clients' buffers; via `amdgpu_vm_pt_create()` a short-backed GPU page-table BO lets PTE writes land outside their allocation, giving control over GPU virtual address translations.\nA:H - The overrun hits `BUG_ON(start + size > res->size)` in `amdgpu_res_first()` and `BUG_ON(size > cur->remaining)` in `amdgpu_res_next()`, and the bogus block order (up to 63) drives absurd mapping sizes causing GPU page faults, GPU resets and hangs — all trivially repeatable by an unprivileged process." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/drm_buddy.c" ], "versions": [ { "version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2", "status": "affected", "versionType": "git" }, { "version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/drm_buddy.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2" }, { "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91" } ], "title": "drm/buddy: Fix alloc_range() error handling code", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-17T19:09:43.602719Z", "id": "CVE-2024-26911", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:09:57.405Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.625Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "tags": [ "x_transferred" ] } ] } ] } }