PT-2025-8840 · Linux+5 · Linux Kernel+5
Published
2024-10-17
·
Updated
2026-05-26
·
CVE-2024-58018
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.9.0-rc6+
Description
A vulnerability in the Linux kernel has been identified, specifically in the nvkm module. The issue arises when handling large RPC requests, where the
r535 gsp cmdq push() function waits for available space in the GSP cmdq buffer. However, it incorrectly calculates the available buffer space, potentially leading to overwriting of the RPC request being read by GSP, causing a hang due to corrupted RPC requests.Recommendations
For Linux kernel versions prior to 6.9.0-rc6+, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the
r535 gsp msgq wait() function until a patch is available. Restrict access to the vulnerable module nvkm to minimize the risk of exploitation. Avoid using the r535 gsp rpc push() function in the affected API endpoint until the issue is resolved.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu