CVE-2024-26797 (GCVE-0-2024-26797)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-08-05 11:27
VLAI
Title
drm/amd/display: Prevent potential buffer overflow in map_hw_resources
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent potential buffer overflow in map_hw_resources Adds a check in the map_hw_resources function to prevent a potential buffer overflow. The function was accessing arrays using an index that could potentially be greater than the size of the arrays, leading to a buffer overflow. Adds a check to ensure that the index is within the bounds of the arrays. If the index is out of bounds, an error message is printed and break it will continue execution with just ignoring extra data early to prevent the buffer overflow. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7 drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7966f319c66d9468623c6a6a017ecbc0dd79be75 , < 50a6302cf881f67f1410461a68fe9eabd00ff31d (git)
Affected: 7966f319c66d9468623c6a6a017ecbc0dd79be75 , < 0f8ca019544a252d1afb468ce840c6dcbac73af4 (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: 7966f319c66d , < 50a6302cf881 (custom)
Affected: 7966f319c66d , < 0f8ca019544a (custom)
Affected: 6.7
Unaffected: 0 , < 6.7 (custom)
Unaffected: 6.79 , ≤ 6.8 (custom)
Unaffected: 6.8 , ≤ * (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "50a6302cf881",
                "status": "affected",
                "version": "7966f319c66d",
                "versionType": "custom"
              },
              {
                "lessThan": "0f8ca019544a",
                "status": "affected",
                "version": "7966f319c66d",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "6.7"
              },
              {
                "lessThan": "6.7",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.8",
                "status": "unaffected",
                "version": "6.79",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.8",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T16:00:44.653604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-16T14:02:40.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50a6302cf881f67f1410461a68fe9eabd00ff31d",
              "status": "affected",
              "version": "7966f319c66d9468623c6a6a017ecbc0dd79be75",
              "versionType": "git"
            },
            {
              "lessThan": "0f8ca019544a252d1afb468ce840c6dcbac73af4",
              "status": "affected",
              "version": "7966f319c66d9468623c6a6a017ecbc0dd79be75",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\n\nAdds a check in the map_hw_resources function to prevent a potential\nbuffer overflow. The function was accessing arrays using an index that\ncould potentially be greater than the size of the arrays, leading to a\nbuffer overflow.\n\nAdds a check to ensure that the index is within the bounds of the\narrays. If the index is out of bounds, an error message is printed and\nbreak it will continue execution with just ignoring extra data early to\nprevent the buffer overflow.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id\u0027 6 \u003c= 7\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id\u0027 6 \u003c= 7"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through DRM KMS ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on `/dev/dri/cardN` via `amdgpu_dm_atomic_check()` \u2192 `dc_validate_global_state()` \u2192 `dml2_validate()`. No network or remote data path reaches `map_hw_resources()`.\nAC:L - The attacker controls the display configuration submitted in the atomic commit (number of streams, planes, and modes that force ODM combine 2:1/4:1, driving `DPPPerSurface` and hence `num_pipes`), so the out-of-bounds indices are reached deterministically without depending on any condition outside the attacker\u0027s control.\nPR:L - Only an unprivileged local account with access to the DRM device node is needed \u2014 the code path contains no capability check, and any logged-in seat user (or a compositor/kiosk process) can issue the atomic modeset that reaches `map_hw_resources()`.\nUI:N - The attacker performs the modeset himself via ioctl in a loop; no action by another user or victim is required to trigger the overflow.\nS:U - The corruption is confined to kernel heap memory in the same security authority as the exploiting process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop performs out-of-bounds reads of `disp_cfg_to_stream_id[6..7]` and `disp_cfg_to_plane_id[6..7]`, and the resulting leaked heap contents are copied into the DML-to-DC pipe mapping that drives subsequent pipe lookups, so out-of-bounds kernel data becomes observable and usable \u2014 per kernel guidance, an unbounded OOB read plus heap corruption is High.\nI:H - `dml_pipe_idx_to_stream_id[num_pipes]` and friends are written with unbounded `num_pipes`, placing attacker-influenced 32-bit IDs and `true` bytes past the 6-element arrays and past the end of `struct dml2_dml_to_dc_pipe_mapping` into the surrounding `struct dml2_context` heap allocation \u2014 an out-of-bounds write with partially controlled data, which is High.\nA:H - The out-of-bounds writes corrupt DML scratch state and pipe-mapping data that is subsequently used to index `res_ctx.pipe_ctx[]` and program display hardware, readily producing an oops, display-engine hang, or panic (and detectable as a KASAN slab-out-of-bounds), which is a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:19.496Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"
        }
      ],
      "title": "drm/amd/display: Prevent potential buffer overflow in map_hw_resources",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26797",
    "datePublished": "2024-04-04T08:20:26.558Z",
    "dateReserved": "2024-02-19T14:20:24.178Z",
    "dateUpdated": "2026-08-05T11:27:19.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26797",
      "date": "2026-08-10",
      "epss": "0.00249",
      "percentile": "0.1629"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\\n\\nAdds a check in the map_hw_resources function to prevent a potential\\nbuffer overflow. The function was accessing arrays using an index that\\ncould potentially be greater than the size of the arrays, leading to a\\nbuffer overflow.\\n\\nAdds a check to ensure that the index is within the bounds of the\\narrays. If the index is out of bounds, an error message is printed and\\nbreak it will continue execution with just ignoring extra data early to\\nprevent the buffer overflow.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id\u0027 6 \u003c= 7\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id\u0027 6 \u003c= 7\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Previene un posible desbordamiento del b\\u00fafer en map_hw_resources Agrega una verificaci\\u00f3n en la funci\\u00f3n map_hw_resources para evitar un posible desbordamiento del b\\u00fafer. La funci\\u00f3n acced\\u00eda a matrices utilizando un \\u00edndice que potencialmente podr\\u00eda ser mayor que el tama\\u00f1o de las matrices, lo que provocaba un desbordamiento del b\\u00fafer. Agrega una verificaci\\u00f3n para garantizar que el \\u00edndice est\\u00e9 dentro de los l\\u00edmites de las matrices. Si el \\u00edndice est\\u00e1 fuera de los l\\u00edmites, se imprime un mensaje de error y, al interrumpirlo, continuar\\u00e1 la ejecuci\\u00f3n ignorando los datos adicionales antes de tiempo para evitar el desbordamiento del b\\u00fafer. Reportado por smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 error map_hw_resources(): desbordamiento del b\\u00fafer \u0027dml2-\u0026gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id\u0027 6 \u0026lt;= 7 controladores/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 error map_hw_resources(): desbordamiento del b\\u00fafer \u0027dml2-\u0026gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id\u0027 6 \u0026lt;= 7\"}]",
      "id": "CVE-2024-26797",
      "lastModified": "2024-11-21T09:03:05.660",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-04-04T09:15:08.843",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-120\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26797\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:08.843\",\"lastModified\":\"2026-06-17T07:18:22.283\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\\n\\nAdds a check in the map_hw_resources function to prevent a potential\\nbuffer overflow. The function was accessing arrays using an index that\\ncould potentially be greater than the size of the arrays, leading to a\\nbuffer overflow.\\n\\nAdds a check to ensure that the index is within the bounds of the\\narrays. If the index is out of bounds, an error message is printed and\\nbreak it will continue execution with just ignoring extra data early to\\nprevent the buffer overflow.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id\u0027 6 \u003c= 7\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id\u0027 6 \u003c= 7\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Previene un posible desbordamiento del b\u00fafer en map_hw_resources Agrega una verificaci\u00f3n en la funci\u00f3n map_hw_resources para evitar un posible desbordamiento del b\u00fafer. La funci\u00f3n acced\u00eda a matrices utilizando un \u00edndice que potencialmente podr\u00eda ser mayor que el tama\u00f1o de las matrices, lo que provocaba un desbordamiento del b\u00fafer. Agrega una verificaci\u00f3n para garantizar que el \u00edndice est\u00e9 dentro de los l\u00edmites de las matrices. Si el \u00edndice est\u00e1 fuera de los l\u00edmites, se imprime un mensaje de error y, al interrumpirlo, continuar\u00e1 la ejecuci\u00f3n ignorando los datos adicionales antes de tiempo para evitar el desbordamiento del b\u00fafer. Reportado por smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 error map_hw_resources(): desbordamiento del b\u00fafer \u0027dml2-\u0026gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id\u0027 6 \u0026lt;= 7 controladores/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 error map_hw_resources(): desbordamiento del b\u00fafer \u0027dml2-\u0026gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id\u0027 6 \u0026lt;= 7\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7966f319c66d9468623c6a6a017ecbc0dd79be75\",\"lessThan\":\"50a6302cf881f67f1410461a68fe9eabd00ff31d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7966f319c66d9468623c6a6a017ecbc0dd79be75\",\"lessThan\":\"0f8ca019544a252d1afb468ce840c6dcbac73af4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"7966f319c66d\",\"lessThan\":\"50a6302cf881\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7966f319c66d\",\"lessThan\":\"0f8ca019544a\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.79\",\"lessThanOrEqual\":\"6.8\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-04T16:00:44.653604Z\",\"id\":\"CVE-2024-26797\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:36:17+00:00",
      "cve": "CVE-2024-26797",
      "id": "CVE-2024-26797",
      "initial_release_date": "2024-04-04T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: Prevent potential buffer overflow in map_hw_resources",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26797.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:01:04Z",
      "cve": "CVE-2024-26797",
      "id": "CVE-2024-26797",
      "initial_release_date": "2024-04-09T02:29:03Z",
      "product_status:known_not_affected": "309",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26797",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26797.json",
      "version": "33"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.520Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26797\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T16:00:44.653604Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"7966f319c66d\", \"lessThan\": \"50a6302cf881\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7966f319c66d\", \"lessThan\": \"0f8ca019544a\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"6.79\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-16T13:56:37.589Z\"}}], \"cna\": {\"title\": \"drm/amd/display: Prevent potential buffer overflow in map_hw_resources\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through DRM KMS ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on `/dev/dri/cardN` via `amdgpu_dm_atomic_check()` \\u2192 `dc_validate_global_state()` \\u2192 `dml2_validate()`. No network or remote data path reaches `map_hw_resources()`.\\nAC:L - The attacker controls the display configuration submitted in the atomic commit (number of streams, planes, and modes that force ODM combine 2:1/4:1, driving `DPPPerSurface` and hence `num_pipes`), so the out-of-bounds indices are reached deterministically without depending on any condition outside the attacker\u0027s control.\\nPR:L - Only an unprivileged local account with access to the DRM device node is needed \\u2014 the code path contains no capability check, and any logged-in seat user (or a compositor/kiosk process) can issue the atomic modeset that reaches `map_hw_resources()`.\\nUI:N - The attacker performs the modeset himself via ioctl in a loop; no action by another user or victim is required to trigger the overflow.\\nS:U - The corruption is confined to kernel heap memory in the same security authority as the exploiting process; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The loop performs out-of-bounds reads of `disp_cfg_to_stream_id[6..7]` and `disp_cfg_to_plane_id[6..7]`, and the resulting leaked heap contents are copied into the DML-to-DC pipe mapping that drives subsequent pipe lookups, so out-of-bounds kernel data becomes observable and usable \\u2014 per kernel guidance, an unbounded OOB read plus heap corruption is High.\\nI:H - `dml_pipe_idx_to_stream_id[num_pipes]` and friends are written with unbounded `num_pipes`, placing attacker-influenced 32-bit IDs and `true` bytes past the 6-element arrays and past the end of `struct dml2_dml_to_dc_pipe_mapping` into the surrounding `struct dml2_context` heap allocation \\u2014 an out-of-bounds write with partially controlled data, which is High.\\nA:H - The out-of-bounds writes corrupt DML scratch state and pipe-mapping data that is subsequently used to index `res_ctx.pipe_ctx[]` and program display hardware, readily producing an oops, display-engine hang, or panic (and detectable as a KASAN slab-out-of-bounds), which is a full availability loss.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7966f319c66d9468623c6a6a017ecbc0dd79be75\", \"lessThan\": \"50a6302cf881f67f1410461a68fe9eabd00ff31d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7966f319c66d9468623c6a6a017ecbc0dd79be75\", \"lessThan\": \"0f8ca019544a252d1afb468ce840c6dcbac73af4\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d\"}, {\"url\": \"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\\n\\nAdds a check in the map_hw_resources function to prevent a potential\\nbuffer overflow. The function was accessing arrays using an index that\\ncould potentially be greater than the size of the arrays, leading to a\\nbuffer overflow.\\n\\nAdds a check to ensure that the index is within the bounds of the\\narrays. If the index is out of bounds, an error message is printed and\\nbreak it will continue execution with just ignoring extra data early to\\nprevent the buffer overflow.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id\u0027 6 \u003c= 7\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow \u0027dml2-\u003ev20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id\u0027 6 \u003c= 7\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:19.496Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26797\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:19.496Z\", \"dateReserved\": \"2024-02-19T14:20:24.178Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:26.558Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.