CVE-2024-26911 (GCVE-0-2024-26911)

Vulnerability from cvelistv5 – Published: 2024-04-17 15:59 – Updated: 2026-08-05 11:28
VLAI
Title
drm/buddy: Fix alloc_range() error handling code
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fix alloc_range() error handling code Few users have observed display corruption when they boot the machine to KDE Plasma or playing games. We have root caused the problem that whenever alloc_range() couldn't find the required memory blocks the function was returning SUCCESS in some of the corner cases. The right approach would be if the total allocated size is less than the required size, the function should return -ENOSPC.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0a1844bf0b532d84324453374ad6845f64066c28 , < 4b59c3fada06e5e8010ef7700689c71986e667a2 (git)
Affected: 0a1844bf0b532d84324453374ad6845f64066c28 , < 8746c6c9dfa31d269c65dd52ab42fde0720b7d91 (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T19:09:43.602719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T19:09:57.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.625Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_buddy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            },
            {
              "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_buddy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn\u0027t\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable allocator is reached only through DRM ioctls on a local device node (`/dev/dri/renderD128` or the primary node\u0027s dumb-buffer ioctl); there is no network-facing path to drm_buddy. Exploitation requires local code execution on the machine.\nAC:L - The attacker fully controls the inputs that drive the bug \u2014 allocation size and VRAM fragmentation \u2014 via repeated GEM create/destroy and CS submissions, so steering `__alloc_contig_try_harder()` to a free block whose RHS range overruns `mm-\u003esize` (or whose LHS offset underflows) is deterministic grooming, not a race or a condition outside their control.\nPR:L - An unprivileged local user with render-node access can trigger it; on typical desktop distros `/dev/dri/renderD128` is world-accessible, and GPU-accelerated containers, Android apps and ChromeOS sandboxes are granted it. `AMDGPU_GEM_CREATE`, `AMDGPU_CS`, `AMDGPU_GEM_VA` and `DRM_IOCTL_MODE_CREATE_DUMB` require no capability.\nUI:N - The attacker performs the allocations from their own process and consumes the resulting undersized buffer object themselves; no action by any other user is needed.\nS:U - The mis-sized allocation, the type-confused block, and the resulting VRAM accesses all remain under the kernel\u0027s own security authority \u2014 this is standard in-kernel memory corruption, not a VM escape or IOMMU boundary bypass.\nC:H - The buffer\u0027s tail is backed by VRAM belonging to other GPU clients, the scanout framebuffer, or kernel BOs, and the cursor overrun yields an attacker-influenced out-of-bounds VRAM offset; the attacker reads that memory via GPU shaders, CPU mmap of the BO, or dma-buf export \u2014 the reported \"display corruption\" is other buffers\u0027 contents being surfaced.\nI:H - The same aliased and out-of-bounds VRAM is writable through the attacker\u0027s GPU commands and CPU mappings, corrupting other clients\u0027 buffers; via `amdgpu_vm_pt_create()` a short-backed GPU page-table BO lets PTE writes land outside their allocation, giving control over GPU virtual address translations.\nA:H - The overrun hits `BUG_ON(start + size \u003e res-\u003esize)` in `amdgpu_res_first()` and `BUG_ON(size \u003e cur-\u003eremaining)` in `amdgpu_res_next()`, and the bogus block order (up to 63) drives absurd mapping sizes causing GPU page faults, GPU resets and hangs \u2014 all trivially repeatable by an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:15.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"
        }
      ],
      "title": "drm/buddy: Fix alloc_range() error handling code",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26911",
    "datePublished": "2024-04-17T15:59:22.597Z",
    "dateReserved": "2024-02-19T14:20:24.190Z",
    "dateUpdated": "2026-08-05T11:28:15.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26911",
      "date": "2026-08-04",
      "epss": "0.00191",
      "percentile": "0.08998"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T16:15:07.920\",\"lastModified\":\"2026-06-17T07:18:40.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/buddy: Fix alloc_range() error handling code\\n\\nFew users have observed display corruption when they boot\\nthe machine to KDE Plasma or playing games. We have root\\ncaused the problem that whenever alloc_range() couldn\u0027t\\nfind the required memory blocks the function was returning\\nSUCCESS in some of the corner cases.\\n\\nThe right approach would be if the total allocated size\\nis less than the required size, the function should\\nreturn -ENOSPC.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/buddy: corrige el c\u00f3digo de manejo de errores alloc_range() Pocos usuarios han observado da\u00f1os en la pantalla cuando inician la m\u00e1quina en KDE Plasma o juegan juegos. Hemos causado el problema de que cada vez que alloc_range() no pod\u00eda encontrar los bloques de memoria requeridos, la funci\u00f3n devolv\u00eda \u00c9XITO en algunos de los casos de esquina. El enfoque correcto ser\u00eda que si el tama\u00f1o total asignado es menor que el tama\u00f1o requerido, la funci\u00f3n deber\u00eda devolver -ENOSPC.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_buddy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0a1844bf0b532d84324453374ad6845f64066c28\",\"lessThan\":\"4b59c3fada06e5e8010ef7700689c71986e667a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a1844bf0b532d84324453374ad6845f64066c28\",\"lessThan\":\"8746c6c9dfa31d269c65dd52ab42fde0720b7d91\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_buddy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.6\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T19:09:43.602719Z\",\"id\":\"CVE-2024-26911\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"6.7.0\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"ABAABB52-E12B-4FA5-9F6F-94F0E111832F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:09:19+00:00",
      "cve": "CVE-2024-26911",
      "id": "CVE-2024-26911",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/buddy: Fix alloc_range() error handling code",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26911.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.625Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26911\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T19:09:43.602719Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T19:09:51.244Z\"}}], \"cna\": {\"title\": \"drm/buddy: Fix alloc_range() error handling code\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0a1844bf0b532d84324453374ad6845f64066c28\", \"lessThan\": \"4b59c3fada06e5e8010ef7700689c71986e667a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0a1844bf0b532d84324453374ad6845f64066c28\", \"lessThan\": \"8746c6c9dfa31d269c65dd52ab42fde0720b7d91\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/drm_buddy.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/drm_buddy.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2\"}, {\"url\": \"https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/buddy: Fix alloc_range() error handling code\\n\\nFew users have observed display corruption when they boot\\nthe machine to KDE Plasma or playing games. We have root\\ncaused the problem that whenever alloc_range() couldn\u0027t\\nfind the required memory blocks the function was returning\\nSUCCESS in some of the corner cases.\\n\\nThe right approach would be if the total allocated size\\nis less than the required size, the function should\\nreturn -ENOSPC.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:21:09.745Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26911\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:21:09.745Z\", \"dateReserved\": \"2024-02-19T14:20:24.190Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T15:59:22.597Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.