GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-58091 (GCVE-0-2024-58091)

Vulnerability from cvelistv5 – Published: 2025-03-27 14:57 – Updated: 2026-08-05 11:47
VLAI
Title
drm/fbdev-dma: Add shadow buffering for deferred I/O
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed by struct page, so we cannot rely on it for deferred I/O. Allocate a shadow buffer for drivers that require deferred I/O and use it as framebuffer memory. Fixes driver errors about being "Unable to handle kernel NULL pointer dereference at virtual address" or "Unable to handle kernel paging request at virtual address". The patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial allocation, which creates the DMA-backed buffer object, and a tail that sets up the fbdev data structures. There is a tail function for direct memory mappings and a tail function for deferred I/O with the shadow buffer. It is no longer possible to use deferred I/O without shadow buffer. It can be re-added if there exists a reliably test for usable struct page in the allocated DMA-backed buffer object.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48 , < 0d087de947babf7ed70029d042abcc6ed06ff415 (git)
Affected: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48 , < cdc581169942de3b9e2648cfbd98c5ff9111c2c8 (git)
Affected: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48 , < 3603996432997f7c88da37a97062a46cda01ac9d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.36 , ≤ 6.12.* (semver)
Unaffected: 6.13.6 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fbdev_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d087de947babf7ed70029d042abcc6ed06ff415",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            },
            {
              "lessThan": "cdc581169942de3b9e2648cfbd98c5ff9111c2c8",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            },
            {
              "lessThan": "3603996432997f7c88da37a97062a46cda01ac9d",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fbdev_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fbdev-dma: Add shadow buffering for deferred I/O\n\nDMA areas are not necessarily backed by struct page, so we cannot\nrely on it for deferred I/O. Allocate a shadow buffer for drivers\nthat require deferred I/O and use it as framebuffer memory.\n\nFixes driver errors about being \"Unable to handle kernel NULL pointer\ndereference at virtual address\" or \"Unable to handle kernel paging\nrequest at virtual address\".\n\nThe patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial\nallocation, which creates the DMA-backed buffer object, and a tail\nthat sets up the fbdev data structures. There is a tail function for\ndirect memory mappings and a tail function for deferred I/O with\nthe shadow buffer.\n\nIt is no longer possible to use deferred I/O without shadow buffer.\nIt can be re-added if there exists a reliably test for usable struct\npage in the allocated DMA-backed buffer object."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening and mmap()ing the local `/dev/fb0` character device; there is no remote or adjacent-network path to the fbdev deferred-I/O fault handler.\nAC:L - On an affected system the attacker simply mmaps the framebuffer and touches the mapping, deterministically entering `fb_deferred_io_fault()` with a non-struct-page DMA address; no race or uncontrollable precondition is involved.\nPR:L - `fb_open()`/`fb_mmap()` perform no capability checks \u2014 only `/dev/fb0` file permissions apply, and on the embedded/Raspberry Pi-class systems running the affected SPI-panel and LCDC drivers the ordinary console user is in the `video` group.\nUI:N - The attacker performs the mmap and the write to its own mapping; no action by another user or administrator is needed.\nS:U - The corruption and crash occur within the kernel of the same machine and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The fault handler hands a fabricated `struct page` (from an unbacked physical frame) to the VM layer and installs it in the attacker\u0027s page tables, so mismanaged/aliased page metadata can expose kernel-owned or reserved physical memory contents to userspace.\nI:H - Before crashing, the path writes through the bogus page pointer \u2014 refcount increment, `page-\u003emapping`, `page-\u003eindex` set to the attacker-controlled `pgoff`, and `PG_locked` \u2014 and the fake page can later be released into the buddy allocator, giving page-metadata corruption that is leverageable for further memory corruption.\nA:H - The documented and reproducible outcome is an immediate kernel oops (\"Unable to handle kernel NULL pointer dereference\"/\"Unable to handle kernel paging request\"), a full denial of service triggerable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:40.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d087de947babf7ed70029d042abcc6ed06ff415"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdc581169942de3b9e2648cfbd98c5ff9111c2c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3603996432997f7c88da37a97062a46cda01ac9d"
        }
      ],
      "title": "drm/fbdev-dma: Add shadow buffering for deferred I/O",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58091",
    "datePublished": "2025-03-27T14:57:03.560Z",
    "dateReserved": "2025-03-06T15:52:09.188Z",
    "dateUpdated": "2026-08-05T11:47:40.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58091",
      "date": "2026-09-16",
      "epss": "0.0021",
      "percentile": "0.11429"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58091\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T15:15:54.237\",\"lastModified\":\"2026-08-04T11:22:39.340\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/fbdev-dma: Add shadow buffering for deferred I/O\\n\\nDMA areas are not necessarily backed by struct page, so we cannot\\nrely on it for deferred I/O. Allocate a shadow buffer for drivers\\nthat require deferred I/O and use it as framebuffer memory.\\n\\nFixes driver errors about being \\\"Unable to handle kernel NULL pointer\\ndereference at virtual address\\\" or \\\"Unable to handle kernel paging\\nrequest at virtual address\\\".\\n\\nThe patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial\\nallocation, which creates the DMA-backed buffer object, and a tail\\nthat sets up the fbdev data structures. There is a tail function for\\ndirect memory mappings and a tail function for deferred I/O with\\nthe shadow buffer.\\n\\nIt is no longer possible to use deferred I/O without shadow buffer.\\nIt can be re-added if there exists a reliably test for usable struct\\npage in the allocated DMA-backed buffer object.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/fbdev-dma: Se ha a\u00f1adido un b\u00fafer de sombra para E/S diferida. Las \u00e1reas de DMA no est\u00e1n necesariamente respaldadas por struct page, por lo que no podemos confiar en \u00e9l para la E/S diferida. Se asigna un b\u00fafer de sombra a los controladores que requieren E/S diferida y se utiliza como memoria de framebuffer. Se corrigen los errores del controlador \\\"No se puede gestionar la desreferencia de puntero nulo del kernel en la direcci\u00f3n virtual\\\" o \\\"No se puede gestionar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual\\\". El parche divide drm_fbdev_dma_driver_fbdev_probe() en una asignaci\u00f3n inicial, que crea el objeto de b\u00fafer respaldado por DMA, y una cola, que configura las estructuras de datos fbdev. Hay una funci\u00f3n de cola para asignaciones directas de memoria y otra para E/S diferida con el b\u00fafer de sombra. Ya no es posible utilizar la E/S diferida sin el b\u00fafer de sombra. Se puede volver a agregar si existe una prueba confiable de una p\u00e1gina de estructura utilizable en el objeto de b\u00fafer respaldado por DMA asignado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_fbdev_dma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5ab91447aa13b8b98bc11f5326f33500b0ee2c48\",\"lessThan\":\"0d087de947babf7ed70029d042abcc6ed06ff415\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5ab91447aa13b8b98bc11f5326f33500b0ee2c48\",\"lessThan\":\"cdc581169942de3b9e2648cfbd98c5ff9111c2c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5ab91447aa13b8b98bc11f5326f33500b0ee2c48\",\"lessThan\":\"3603996432997f7c88da37a97062a46cda01ac9d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_fbdev_dma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.36\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.6\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.36\",\"matchCriteriaId\":\"56F467DF-285E-4CC3-9D4E-9740F7EF57E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.6\",\"matchCriteriaId\":\"64F12D9B-71C2-4CD7-A288-0D5EF1709620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d087de947babf7ed70029d042abcc6ed06ff415\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3603996432997f7c88da37a97062a46cda01ac9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdc581169942de3b9e2648cfbd98c5ff9111c2c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:42+00:00",
      "cve": "CVE-2024-58091",
      "id": "CVE-2024-58091",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/fbdev-dma: Add shadow buffering for deferred I/O",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58091.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.