{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26939", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.196Z", "datePublished": "2024-05-01T05:17:44.370Z", "dateUpdated": "2026-08-05T11:28:28.848Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:28.848Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/vma: Fix UAF on destroy against retire race\n\nObject debugging tools were sporadically reporting illegal attempts to\nfree a still active i915 VMA object when parking a GT believed to be idle.\n\n[161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915]\n[161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debug_print_object+0x80/0xb0\n...\n[161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1-CI_DRM_13375-g003f860e5577+ #1\n[161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022\n[161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915]\n[161.360592] RIP: 0010:debug_print_object+0x80/0xb0\n...\n[161.361347] debug_object_free+0xeb/0x110\n[161.361362] i915_active_fini+0x14/0x130 [i915]\n[161.361866] release_references+0xfe/0x1f0 [i915]\n[161.362543] i915_vma_parked+0x1db/0x380 [i915]\n[161.363129] __gt_park+0x121/0x230 [i915]\n[161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915]\n\nThat has been tracked down to be happening when another thread is\ndeactivating the VMA inside __active_retire() helper, after the VMA's\nactive counter has been already decremented to 0, but before deactivation\nof the VMA's object is reported to the object debugging tool.\n\nWe could prevent from that race by serializing i915_active_fini() with\n__active_retire() via ref->tree_lock, but that wouldn't stop the VMA from\nbeing used, e.g. from __i915_vma_retire() called at the end of\n__active_retire(), after that VMA has been already freed by a concurrent\ni915_vma_destroy() on return from the i915_active_fini(). Then, we should\nrather fix the issue at the VMA level, not in i915_active.\n\nSince __i915_vma_parked() is called from __gt_park() on last put of the\nGT's wakeref, the issue could be addressed by holding the GT wakeref long\nenough for __active_retire() to complete before that wakeref is released\nand the GT parked.\n\nI believe the issue was introduced by commit d93939730347 (\"drm/i915:\nRemove the vma refcount\") which moved a call to i915_active_fini() from\na dropped i915_vma_release(), called on last put of the removed VMA kref,\nto i915_vma_parked() processing path called on last put of a GT wakeref.\nHowever, its visibility to the object debugging tool was suppressed by a\nbug in i915_active that was fixed two weeks later with commit e92eb246feb9\n(\"drm/i915/active: Fix missing debug object activation\").\n\nA VMA associated with a request doesn't acquire a GT wakeref by itself.\nInstead, it depends on a wakeref held directly by the request's active\nintel_context for a GT associated with its VM, and indirectly on that\nintel_context's engine wakeref if the engine belongs to the same GT as the\nVMA's VM. Those wakerefs are released asynchronously to VMA deactivation.\n\nFix the issue by getting a wakeref for the VMA's GT when activating it,\nand putting that wakeref only after the VMA is deactivated. However,\nexclude global GTT from that processing path, otherwise the GPU never goes\nidle. Since __i915_vma_retire() may be called from atomic contexts, use\nasync variant of wakeref put. Also, to avoid circular locking dependency,\ntake care of acquiring the wakeref before VM mutex when both are needed.\n\nv7: Add inline comments with justifications for:\n - using untracked variants of intel_gt_pm_get/put() (Nirmoy),\n - using async variant of _put(),\n - not getting the wakeref in case of a global GTT,\n - always getting the first wakeref outside vm->mutex.\nv6: Since __i915_vma_active/retire() callbacks are not serialized, storing\n a wakeref tracking handle inside struct i915_vma is not safe, and\n there is no other good place for that. Use untracked variants of\n intel_gt_pm_get/put_async().\nv5: Replace \"tile\" with \"GT\" across commit description (Rodrigo),\n - \n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through DRM ioctls (I915_GEM_EXECBUFFER2, context/vm create-destroy, GEM handle close) on /dev/dri/renderD128 or /dev/dri/card0, requiring local access to the machine. There is no network-facing path into the i915 VMA lifecycle.\nAC:L - The attacker controls both sides of the race — GPU batch submission drives request retirement (__active_retire), while closing handles/contexts and letting the GPU idle drives __gt_park() → i915_vma_parked() → i915_vma_free() — and can loop it indefinitely across CPUs with a large closed_vma list to widen the window. Intel CI hit this race spontaneously without any adversarial timing.\nPR:L - All required ioctls are marked DRM_RENDER_ALLOW, so any unprivileged local user with render-node access (standard for any desktop/graphical user, Android app, or container with /dev/dri passed through) can reach the code with no capabilities. No DRM_MASTER, CAP_SYS_ADMIN, or root is needed.\nUI:N - The attacking process performs every step itself — creating objects and contexts, submitting batches, closing handles, and idling the GPU. No victim action is involved.\nS:U - The use-after-free corrupts kernel slab memory and its impact stays within the host kernel's security authority. The GVT virtualization path uses GGTT-pinned VMAs, which the fix explicitly excludes, so no guest-to-host boundary is crossed.\nC:H - After the VMA slab object is freed and reallocated, __active_retire() and __i915_vma_retire() read the ref->retire function pointer and vma->obj from freed memory, which combined with heap spraying of the mergeable slab_vmas cache yields kernel information disclosure and arbitrary-read primitives.\nI:H - The freed-memory read of ref->retire is immediately followed by an indirect call through it, and vma->obj is loaded from freed memory and passed to kref_put() — giving both control-flow hijack and arbitrary-decrement/premature-free primitives that lead to privilege escalation.\nA:H - The bug is a slab use-after-free that manifests as a debugobjects WARNING and reliably oopses or panics the kernel (KASAN reports slab-use-after-free), and it can be triggered repeatedly by an unprivileged process to take the system down." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/i915_vma.c" ], "versions": [ { "version": "d93939730347360db0afe6a4367451b6f84ab7b1", "lessThan": "704edc9252f4988ae1ad7dafa23d0db8d90d7190", "status": "affected", "versionType": "git" }, { "version": "d93939730347360db0afe6a4367451b6f84ab7b1", "lessThan": "5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5", "status": "affected", "versionType": "git" }, { "version": "d93939730347360db0afe6a4367451b6f84ab7b1", "lessThan": "59b2626dd8c8a2e13f18054b3530e0c00073d79f", "status": "affected", "versionType": "git" }, { "version": "d93939730347360db0afe6a4367451b6f84ab7b1", "lessThan": "0e45882ca829b26b915162e8e86dbb1095768e9e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/i915_vma.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.88", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.8.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/704edc9252f4988ae1ad7dafa23d0db8d90d7190" }, { "url": "https://git.kernel.org/stable/c/5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5" }, { "url": "https://git.kernel.org/stable/c/59b2626dd8c8a2e13f18054b3530e0c00073d79f" }, { "url": "https://git.kernel.org/stable/c/0e45882ca829b26b915162e8e86dbb1095768e9e" } ], "title": "drm/i915/vma: Fix UAF on destroy against retire race", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free" } ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-06T18:59:58.125327Z", "id": "CVE-2024-26939", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T19:00:13.886Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.670Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/704edc9252f4988ae1ad7dafa23d0db8d90d7190", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/59b2626dd8c8a2e13f18054b3530e0c00073d79f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0e45882ca829b26b915162e8e86dbb1095768e9e", "tags": [ "x_transferred" ] } ] } ] } }