PT-2025-2750 · Linux+3 · Linux Kernel+3
Published
2024-12-06
·
Updated
2025-09-23
·
CVE-2024-46896
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.74
Description:
The issue is related to the Linux kernel, specifically in the drm/amdgpu component. It occurs when a CS fails validation and is rejected after
job->num ibs is incremented, leading to a crash due to a bogus ring value. The problem arises because the initialization of (*job)->base.sched done in amdgpu job alloc is overwritten by memset. To fix this, a NULL pointer is passed to amdgpu ib free(), as the device is not used in this function.Recommendations:
For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider modifying the
amdgpu ib free() function to accept a NULL pointer, but this should be done with caution and ideally by applying the official patch.Exploit
Fix
NULL Pointer Dereference
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse