Vulnerability-Lookup

GHSA-G5VG-RVQ4-MQ5P

Vulnerability from github – Published: 2024-04-17 18:31 – Updated: 2024-04-29 21:30

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/buddy: Fix alloc_range() error handling code

Few users have observed display corruption when they boot the machine to KDE Plasma or playing games. We have root caused the problem that whenever alloc_range() couldn't find the required memory blocks the function was returning SUCCESS in some of the corner cases.

The right approach would be if the total allocated size is less than the required size, the function should return -ENOSPC.

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-26911"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-17T16:15:07Z",
    "severity": "LOW"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn\u0027t\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC.",
  "id": "GHSA-g5vg-rvq4-mq5p",
  "modified": "2024-04-29T21:30:34Z",
  "published": "2024-04-17T18:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26911"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-26911 (GCVE-0-2024-26911)

Vulnerability from cvelistv5 – Published: 2024-04-17 15:59 – Updated: 2026-08-05 11:28

Title

drm/buddy: Fix alloc_range() error handling code

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fix alloc_range() error handling code Few users have observed display corruption when they boot the machine to KDE Plasma or playing games. We have root caused the problem that whenever alloc_range() couldn't find the required memory blocks the function was returning SUCCESS in some of the corner cases. The right approach would be if the total allocated size is less than the required size, the function should return -ENOSPC.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 19:09 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7100 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/4b59c3fada06e5e80…
https://git.kernel.org/stable/c/8746c6c9dfa31d269…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0a1844bf0b532d84324453374ad6845f64066c28 , < 4b59c3fada06e5e8010ef7700689c71986e667a2 (git) Affected: 0a1844bf0b532d84324453374ad6845f64066c28 , < 8746c6c9dfa31d269c65dd52ab42fde0720b7d91 (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T19:09:43.602719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T19:09:57.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.625Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_buddy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            },
            {
              "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_buddy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn\u0027t\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable allocator is reached only through DRM ioctls on a local device node (`/dev/dri/renderD128` or the primary node\u0027s dumb-buffer ioctl); there is no network-facing path to drm_buddy. Exploitation requires local code execution on the machine.\nAC:L - The attacker fully controls the inputs that drive the bug \u2014 allocation size and VRAM fragmentation \u2014 via repeated GEM create/destroy and CS submissions, so steering `__alloc_contig_try_harder()` to a free block whose RHS range overruns `mm-\u003esize` (or whose LHS offset underflows) is deterministic grooming, not a race or a condition outside their control.\nPR:L - An unprivileged local user with render-node access can trigger it; on typical desktop distros `/dev/dri/renderD128` is world-accessible, and GPU-accelerated containers, Android apps and ChromeOS sandboxes are granted it. `AMDGPU_GEM_CREATE`, `AMDGPU_CS`, `AMDGPU_GEM_VA` and `DRM_IOCTL_MODE_CREATE_DUMB` require no capability.\nUI:N - The attacker performs the allocations from their own process and consumes the resulting undersized buffer object themselves; no action by any other user is needed.\nS:U - The mis-sized allocation, the type-confused block, and the resulting VRAM accesses all remain under the kernel\u0027s own security authority \u2014 this is standard in-kernel memory corruption, not a VM escape or IOMMU boundary bypass.\nC:H - The buffer\u0027s tail is backed by VRAM belonging to other GPU clients, the scanout framebuffer, or kernel BOs, and the cursor overrun yields an attacker-influenced out-of-bounds VRAM offset; the attacker reads that memory via GPU shaders, CPU mmap of the BO, or dma-buf export \u2014 the reported \"display corruption\" is other buffers\u0027 contents being surfaced.\nI:H - The same aliased and out-of-bounds VRAM is writable through the attacker\u0027s GPU commands and CPU mappings, corrupting other clients\u0027 buffers; via `amdgpu_vm_pt_create()` a short-backed GPU page-table BO lets PTE writes land outside their allocation, giving control over GPU virtual address translations.\nA:H - The overrun hits `BUG_ON(start + size \u003e res-\u003esize)` in `amdgpu_res_first()` and `BUG_ON(size \u003e cur-\u003eremaining)` in `amdgpu_res_next()`, and the bogus block order (up to 63) drives absurd mapping sizes causing GPU page faults, GPU resets and hangs \u2014 all trivially repeatable by an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:15.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"
        }
      ],
      "title": "drm/buddy: Fix alloc_range() error handling code",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26911",
    "datePublished": "2024-04-17T15:59:22.597Z",
    "dateReserved": "2024-02-19T14:20:24.190Z",
    "dateUpdated": "2026-08-05T11:28:15.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted