PT-2024-29263 · Linux+5 · Linux Kernel+5
Geert Uytterhoeven
+1
·
Published
2024-06-17
·
Updated
2025-09-29
·
CVE-2024-41094
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.23-06226-g4986cc3e1b75-dirty #250
Description
The vulnerability is related to the drm/fbdev-dma module in the Linux kernel. It occurs when the
smem start is set, which can break systems where DMA memory is backed by vmalloc address space. The issue arises because DMA memory is assumed to be contiguous in physical address space, which is not guaranteed by vmalloc(). To resolve this, the module flag drm leak fbdev smem should be checked when DRM allocates the instance of struct fb info. The fbdev-dma then only sets smem start if required, and the framebuffer should not be located in vmalloc address space.Recommendations
To resolve the issue, check the module flag
drm leak fbdev smem when DRM allocates the instance of struct fb info. Then, only set smem start if required via FBINFO HIDE SMEM START. Also, ensure the framebuffer is not located in vmalloc address space.As a temporary workaround, consider disabling the
drm fbdev dma helper fb probe function until a patch is available. Restrict access to the drm fbdev dma module to minimize the risk of exploitation. Avoid using the smem start parameter in the affected kernel versions until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu