CVE-2024-35951 (GCVE-0-2024-35951)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:41 – Updated: 2026-08-05 11:31
VLAI
Title
drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() Subject: [PATCH] drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() If some the pages or sgt allocation failed, we shouldn't release the pages ref we got earlier, otherwise we will end up with unbalanced get/put_pages() calls. We should instead leave everything in place and let the BO release function deal with extra cleanup when the object is destroyed, or let the fault handler try again next time it's called.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 187d2929206e6b098312c174ea873e4cedf5420d , < 31806711e8a4b75e09b1c43652f2a6420e6e1002 (git)
Affected: 187d2929206e6b098312c174ea873e4cedf5420d , < e18070c622c63f0cab170348e320454728c277aa (git)
Affected: 187d2929206e6b098312c174ea873e4cedf5420d , < 1fc9af813b25e146d3607669247d0f970f5a87c3 (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 6.6.28 , ≤ 6.6.* (semver)
Unaffected: 6.8.7 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T19:20:08.650498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:35.617Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.983Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31806711e8a4b75e09b1c43652f2a6420e6e1002",
              "status": "affected",
              "version": "187d2929206e6b098312c174ea873e4cedf5420d",
              "versionType": "git"
            },
            {
              "lessThan": "e18070c622c63f0cab170348e320454728c277aa",
              "status": "affected",
              "version": "187d2929206e6b098312c174ea873e4cedf5420d",
              "versionType": "git"
            },
            {
              "lessThan": "1fc9af813b25e146d3607669247d0f970f5a87c3",
              "status": "affected",
              "version": "187d2929206e6b098312c174ea873e4cedf5420d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.28",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.7",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\n\nSubject: [PATCH] drm/panfrost: Fix the error path in\n panfrost_mmu_map_fault_addr()\n\nIf some the pages or sgt allocation failed, we shouldn\u0027t release the\npages ref we got earlier, otherwise we will end up with unbalanced\nget/put_pages() calls. We should instead leave everything in place\nand let the BO release function deal with extra cleanup when the object\nis destroyed, or let the fault handler try again next time it\u0027s called."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through local ioctls (PANFROST_IOCTL_CREATE_BO with PANFROST_BO_HEAP, then PANFROST_IOCTL_SUBMIT) on the DRM render node /dev/dri/renderD128. No network or adjacent-network exposure exists.\nAC:L - The error path requires an allocation failure, and the BO\u0027s shmem mapping is deliberately created with __GFP_RETRY_MAYFAIL|GFP_HIGHUSER so it returns -ENOMEM instead of OOM-killing; the attacker fully controls memory pressure and GPU IOVA exhaustion (failing dma_map_sgtable) and can re-trigger the fault in a loop with no race to win.\nPR:L - Both required ioctls are DRM_RENDER_ALLOW, so any local unprivileged user with render-node access \u2014 the default for logged-in desktop users, and for every application on Android/ChromeOS devices using Mali GPUs \u2014 can reach the code with no capabilities.\nUI:N - The attacker performs every step itself: creating the heap BO, submitting the job that faults, and generating the memory pressure. No victim action is involved.\nS:U - The buggy driver and the corrupted memory both reside within the kernel\u0027s security authority; this is standard kernel memory corruption rather than a VM or hypervisor boundary escape.\nC:H - Pages that remain mapped read/write in the GPU address space lose their driver reference and are made evictable, so once reclaimed and reused the attacker\u0027s GPU shaders can read arbitrary recycled kernel and userspace memory through the stale mapping.\nI:H - The stale GPU mappings carry IOMMU_WRITE, giving the attacker an arbitrary write primitive into reclaimed memory, and the leaked/overwritten sg tables plus re-mapping over live PTEs further corrupt the GPU page tables and page refcounts.\nA:H - The unbalanced put_pages corrupts page reference counts and permanently leaks sg tables and DMA/IOVA mappings, while the failed fault disables the GPU address space and kills all jobs on it; repeated triggering yields memory exhaustion and kernel oopses/panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:10.737Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002"
        },
        {
          "url": "https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3"
        }
      ],
      "title": "drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35951",
    "datePublished": "2024-05-20T09:41:45.999Z",
    "dateReserved": "2024-05-17T13:50:33.135Z",
    "dateUpdated": "2026-08-05T11:31:10.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35951",
      "date": "2026-08-07",
      "epss": "0.00244",
      "percentile": "0.15583"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:11:21.000Z",
      "cve": "CVE-2024-35951",
      "id": "msrc_CVE-2024-35951",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-35951.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35951\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:10.577\",\"lastModified\":\"2026-06-17T07:35:47.620\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\\n\\nSubject: [PATCH] drm/panfrost: Fix the error path in\\n panfrost_mmu_map_fault_addr()\\n\\nIf some the pages or sgt allocation failed, we shouldn\u0027t release the\\npages ref we got earlier, otherwise we will end up with unbalanced\\nget/put_pages() calls. We should instead leave everything in place\\nand let the BO release function deal with extra cleanup when the object\\nis destroyed, or let the fault handler try again next time it\u0027s called.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/panfrost: corrige la ruta de error en panfrost_mmu_map_fault_addr() Asunto: [PATCH] drm/panfrost: corrige la ruta de error en panfrost_mmu_map_fault_addr() Si algunas p\u00e1ginas o la asignaci\u00f3n de sgt fallaron, No deber\u00edamos publicar la referencia de p\u00e1ginas que obtuvimos anteriormente, de lo contrario terminaremos con llamadas get/put_pages() desequilibradas. En su lugar, deber\u00edamos dejar todo en su lugar y dejar que la funci\u00f3n de liberaci\u00f3n de BO se encargue de una limpieza adicional cuando se destruya el objeto, o dejar que el controlador de fallos lo intente nuevamente la pr\u00f3xima vez que se llame.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/panfrost/panfrost_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"187d2929206e6b098312c174ea873e4cedf5420d\",\"lessThan\":\"31806711e8a4b75e09b1c43652f2a6420e6e1002\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"187d2929206e6b098312c174ea873e4cedf5420d\",\"lessThan\":\"e18070c622c63f0cab170348e320454728c277aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"187d2929206e6b098312c174ea873e4cedf5420d\",\"lessThan\":\"1fc9af813b25e146d3607669247d0f970f5a87c3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/panfrost/panfrost_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.28\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.7\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-23T19:20:08.650498Z\",\"id\":\"CVE-2024-35951\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"6.6.28\",\"matchCriteriaId\":\"6623BA95-E547-44A4-B0B1-1ABB6F01098B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.7\",\"matchCriteriaId\":\"531BDFB5-EF6A-4707-902E-146368303499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/30/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/30/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:58:28+00:00",
      "cve": "CVE-2024-35951",
      "id": "CVE-2024-35951",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35951.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.983Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35951\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-23T19:20:08.650498Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:20:13.671Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached only through local ioctls (PANFROST_IOCTL_CREATE_BO with PANFROST_BO_HEAP, then PANFROST_IOCTL_SUBMIT) on the DRM render node /dev/dri/renderD128. No network or adjacent-network exposure exists.\\nAC:L - The error path requires an allocation failure, and the BO\u0027s shmem mapping is deliberately created with __GFP_RETRY_MAYFAIL|GFP_HIGHUSER so it returns -ENOMEM instead of OOM-killing; the attacker fully controls memory pressure and GPU IOVA exhaustion (failing dma_map_sgtable) and can re-trigger the fault in a loop with no race to win.\\nPR:L - Both required ioctls are DRM_RENDER_ALLOW, so any local unprivileged user with render-node access \\u2014 the default for logged-in desktop users, and for every application on Android/ChromeOS devices using Mali GPUs \\u2014 can reach the code with no capabilities.\\nUI:N - The attacker performs every step itself: creating the heap BO, submitting the job that faults, and generating the memory pressure. No victim action is involved.\\nS:U - The buggy driver and the corrupted memory both reside within the kernel\u0027s security authority; this is standard kernel memory corruption rather than a VM or hypervisor boundary escape.\\nC:H - Pages that remain mapped read/write in the GPU address space lose their driver reference and are made evictable, so once reclaimed and reused the attacker\u0027s GPU shaders can read arbitrary recycled kernel and userspace memory through the stale mapping.\\nI:H - The stale GPU mappings carry IOMMU_WRITE, giving the attacker an arbitrary write primitive into reclaimed memory, and the leaked/overwritten sg tables plus re-mapping over live PTEs further corrupt the GPU page tables and page refcounts.\\nA:H - The unbalanced put_pages corrupts page reference counts and permanently leaks sg tables and DMA/IOVA mappings, while the failed fault disables the GPU address space and kills all jobs on it; repeated triggering yields memory exhaustion and kernel oopses/panics.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"187d2929206e6b098312c174ea873e4cedf5420d\", \"lessThan\": \"31806711e8a4b75e09b1c43652f2a6420e6e1002\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"187d2929206e6b098312c174ea873e4cedf5420d\", \"lessThan\": \"e18070c622c63f0cab170348e320454728c277aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"187d2929206e6b098312c174ea873e4cedf5420d\", \"lessThan\": \"1fc9af813b25e146d3607669247d0f970f5a87c3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/panfrost/panfrost_mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.28\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/panfrost/panfrost_mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002\"}, {\"url\": \"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa\"}, {\"url\": \"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\\n\\nSubject: [PATCH] drm/panfrost: Fix the error path in\\n panfrost_mmu_map_fault_addr()\\n\\nIf some the pages or sgt allocation failed, we shouldn\u0027t release the\\npages ref we got earlier, otherwise we will end up with unbalanced\\nget/put_pages() calls. We should instead leave everything in place\\nand let the BO release function deal with extra cleanup when the object\\nis destroyed, or let the fault handler try again next time it\u0027s called.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.28\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.7\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:10.737Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35951\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:10.737Z\", \"dateReserved\": \"2024-05-17T13:50:33.135Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:41:45.999Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.