GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26656 (GCVE-0-2024-26656)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:08 – Updated: 2026-08-05 11:26
VLAI
Title
drm/amdgpu: fix use-after-free bug
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <joonkyoj@yonsei.ac.kr>. For example the following code: static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret; arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); } Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled: [ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-02 14:54 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 2e13f88e01ae7e28a7e831bf5c2409c4748e0a60 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < e87e08c94c9541b4e18c4c13f2f605935f512605 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < af054a5fb24a144f99895afce9519d709891894c (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 22f665ecfd1225afa1309ace623157d12bb9bb0c (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 22207fd5c80177b860279653d017474b2812af5e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.1.132 , ≤ 6.1.* (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-02T14:54:50.822759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:23.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:28.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e13f88e01ae7e28a7e831bf5c2409c4748e0a60",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "e87e08c94c9541b4e18c4c13f2f605935f512605",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "af054a5fb24a144f99895afce9519d709891894c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "22f665ecfd1225afa1309ace623157d12bb9bb0c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "22207fd5c80177b860279653d017474b2812af5e",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free bug\n\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\nFor example the following code:\n\nstatic void Syzkaller1(int fd)\n{\n\tstruct drm_amdgpu_gem_userptr arg;\n\tint ret;\n\n\targ.addr = 0xffffffffffff0000;\n\targ.size = 0x80000000; /*2 Gb*/\n\targ.flags = 0x7;\n\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\n}\n\nDue to the address and size are not valid there is a failure in\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\nThe following stack is below when the issue is reproduced when Kazan is enabled:\n\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\n[  +0.000010] Call Trace:\n[  +0.000006]  \u003cTASK\u003e\n[  +0.000007]  ? show_regs+0x6a/0x80\n[  +0.000018]  ? __warn+0xa5/0x1b0\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000018]  ? report_bug+0x24a/0x290\n[  +0.000022]  ? handle_bug+0x46/0x90\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via `DRM_IOCTL_AMDGPU_GEM_USERPTR` on a local AMD GPU device node (`/dev/dri/renderD*` or `card*`); there is no remote or adjacent-network path to `amdgpu_gem_userptr_ioctl()`.\nAC:L - A single ioctl with a fully attacker-chosen `addr`/`size` (e.g. 0xffffffffffff0000 / 0x80000000) deterministically overflows the interval-tree range check and reaches the unbalanced `mmdrop()`; there is no race and no dependence on memory layout.\nPR:L - The ioctl is flagged `DRM_RENDER_ALLOW`, so `drm_ioctl_permit()` waives `DRM_AUTH` for render clients \u2014 any unprivileged local user or sandboxed app with an open render node (standard for desktop sessions, Android apps, and GPU-enabled containers) qualifies, with no capability check anywhere on the path.\nUI:N - The attacker performs the entire sequence itself by opening the render node and issuing the ioctl; no victim action or cooperation is required.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 the calling process\u0027s `mm_struct` and mmu-notifier tree \u2014 with no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - The unbalanced `mmdrop()` frees the live `mm_struct` and its PGD while still in use; reclaiming those objects yields page-table control and therefore arbitrary kernel and cross-process memory disclosure.\nI:H - The same use-after-free plus the `interval_tree_remove()` of a never-inserted node give heap-spray-controlled write primitives \u2014 freeing an in-use PGD allows forging page-table entries for arbitrary memory modification and privilege escalation.\nA:H - The path hits a `WARN_ON` (immediate panic under `panic_on_warn`), corrupts the mm\u0027s notifier interval tree, and tears down the running process\u0027s page tables, reliably crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:34.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e13f88e01ae7e28a7e831bf5c2409c4748e0a60"
        },
        {
          "url": "https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605"
        },
        {
          "url": "https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e"
        }
      ],
      "title": "drm/amdgpu: fix use-after-free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26656",
    "datePublished": "2024-04-02T06:08:43.558Z",
    "dateReserved": "2024-02-19T14:20:24.145Z",
    "dateUpdated": "2026-08-05T11:26:34.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26656",
      "date": "2026-09-16",
      "epss": "0.00234",
      "percentile": "0.14448"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: fix use-after-free bug\\n\\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\\nFor example the following code:\\n\\nstatic void Syzkaller1(int fd)\\n{\\n\\tstruct drm_amdgpu_gem_userptr arg;\\n\\tint ret;\\n\\n\\targ.addr = 0xffffffffffff0000;\\n\\targ.size = 0x80000000; /*2 Gb*/\\n\\targ.flags = 0x7;\\n\\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\\n}\\n\\nDue to the address and size are not valid there is a failure in\\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\\nThe following stack is below when the issue is reproduced when Kazan is enabled:\\n\\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\\n[  +0.000010] Call Trace:\\n[  +0.000006]  \u003cTASK\u003e\\n[  +0.000007]  ? show_regs+0x6a/0x80\\n[  +0.000018]  ? __warn+0xa5/0x1b0\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000018]  ? report_bug+0x24a/0x290\\n[  +0.000022]  ? handle_bug+0x46/0x90\\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/amdgpu: corrige el error de use-after-free. El error se puede activar enviando un solo amdgpu_gem_userptr_ioctl al controlador DRM AMDGPU en cualquier ASIC con una direcci\\u00f3n y tama\\u00f1o no v\\u00e1lidos. El error fue reportado por Joonkyo Jung . Por ejemplo, el siguiente c\\u00f3digo: static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; ret int; arg.addr = 0xffffffffffff0000; arg.tama\\u00f1o = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026amp;arg); } Debido a que la direcci\\u00f3n y el tama\\u00f1o no son v\\u00e1lidos, hay una falla en amdgpu_hmm_register-\u0026gt;mmu_interval_notifier_insert-\u0026gt;__mmu_interval_notifier_insert-\u0026gt; check_shl_overflow, pero incluso en la falla de amdgpu_hmm_register todav\\u00eda llamamos a amdgpu_hmm_unregister en amdgpu_gem_object_free, lo que provoca el acceso a una direcci\\u00f3n incorrecta. La siguiente pila se muestra a continuaci\\u00f3n cuando el problema se reproduce cuando Kazan est\\u00e1 habilitado: [+0.000014] Nombre del hardware: Nombre del producto del sistema ASUS/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 03/12/2020 [+0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] C\\u00f3digo: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u0026lt;0f\u0026gt; 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000 013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 00000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002 657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R1 3 : ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:000000000 0000000 [ +0,000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0,000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [+0.000010] Seguimiento de llamadas: [+0.000006]  [+0.000007] ? show_regs+0x6a/0x80 [+0.000018]? __advertir+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [+0.000018]? report_bug+0x24a/0x290 [+0.000022] ? handle_bug+0x46/0x90 [+0.000015]? exc_invalid_op+0x19/0x50 [+0.000016]? asm_exc_invalid_op+0x1b/0x20 [+0.000017]? kasan_save_stack+0x26/0x50 [+0.000017]? mmu_interval_notifier_remove+0x23b/0x340 [+0.000019]? mmu_interval_notifier_remove+0x327/0x340 [+0.000019]? mmu_interval_notifier_remove+0x23b/0x340 [+0.000020]? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [+0.000014]? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [+0.000013]? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [+0.000023]? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [+0.000014]? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [+0.000013]? sysvec_apic_timer_interrupt+0x57/0xc0 [+0.000020]? srso_return_thunk+0x5/0x5f [+0.000014]? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [+0.000022]? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncado---\"}]",
      "id": "CVE-2024-26656",
      "lastModified": "2024-11-21T09:02:46.717",
      "published": "2024-04-02T07:15:42.760",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:54:41.000Z",
      "cve": "CVE-2024-26656",
      "id": "msrc_CVE-2024-26656",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu: fix use-after-free bug",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26656.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26656\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:42.760\",\"lastModified\":\"2026-08-04T11:16:53.907\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: fix use-after-free bug\\n\\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\\nFor example the following code:\\n\\nstatic void Syzkaller1(int fd)\\n{\\n\\tstruct drm_amdgpu_gem_userptr arg;\\n\\tint ret;\\n\\n\\targ.addr = 0xffffffffffff0000;\\n\\targ.size = 0x80000000; /*2 Gb*/\\n\\targ.flags = 0x7;\\n\\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\\n}\\n\\nDue to the address and size are not valid there is a failure in\\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\\nThe following stack is below when the issue is reproduced when Kazan is enabled:\\n\\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\\n[  +0.000010] Call Trace:\\n[  +0.000006]  \u003cTASK\u003e\\n[  +0.000007]  ? show_regs+0x6a/0x80\\n[  +0.000018]  ? __warn+0xa5/0x1b0\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000018]  ? report_bug+0x24a/0x290\\n[  +0.000022]  ? handle_bug+0x46/0x90\\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amdgpu: corrige el error de use-after-free. El error se puede activar enviando un solo amdgpu_gem_userptr_ioctl al controlador DRM AMDGPU en cualquier ASIC con una direcci\u00f3n y tama\u00f1o no v\u00e1lidos. El error fue reportado por Joonkyo Jung . Por ejemplo, el siguiente c\u00f3digo: static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; ret int; arg.addr = 0xffffffffffff0000; arg.tama\u00f1o = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026amp;arg); } Debido a que la direcci\u00f3n y el tama\u00f1o no son v\u00e1lidos, hay una falla en amdgpu_hmm_register-\u0026gt;mmu_interval_notifier_insert-\u0026gt;__mmu_interval_notifier_insert-\u0026gt; check_shl_overflow, pero incluso en la falla de amdgpu_hmm_register todav\u00eda llamamos a amdgpu_hmm_unregister en amdgpu_gem_object_free, lo que provoca el acceso a una direcci\u00f3n incorrecta. La siguiente pila se muestra a continuaci\u00f3n cuando el problema se reproduce cuando Kazan est\u00e1 habilitado: [+0.000014] Nombre del hardware: Nombre del producto del sistema ASUS/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 03/12/2020 [+0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] C\u00f3digo: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u0026lt;0f\u0026gt; 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000 013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 00000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002 657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R1 3 : ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:000000000 0000000 [ +0,000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0,000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [+0.000010] Seguimiento de llamadas: [+0.000006]  [+0.000007] ? show_regs+0x6a/0x80 [+0.000018]? __advertir+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [+0.000018]? report_bug+0x24a/0x290 [+0.000022] ? handle_bug+0x46/0x90 [+0.000015]? exc_invalid_op+0x19/0x50 [+0.000016]? asm_exc_invalid_op+0x1b/0x20 [+0.000017]? kasan_save_stack+0x26/0x50 [+0.000017]? mmu_interval_notifier_remove+0x23b/0x340 [+0.000019]? mmu_interval_notifier_remove+0x327/0x340 [+0.000019]? mmu_interval_notifier_remove+0x23b/0x340 [+0.000020]? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [+0.000014]? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [+0.000013]? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [+0.000023]? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [+0.000014]? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [+0.000013]? sysvec_apic_timer_interrupt+0x57/0xc0 [+0.000020]? srso_return_thunk+0x5/0x5f [+0.000014]? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [+0.000022]? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"2e13f88e01ae7e28a7e831bf5c2409c4748e0a60\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"e87e08c94c9541b4e18c4c13f2f605935f512605\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"af054a5fb24a144f99895afce9519d709891894c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"22f665ecfd1225afa1309ace623157d12bb9bb0c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"22207fd5c80177b860279653d017474b2812af5e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.132\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-02T14:54:50.822759Z\",\"id\":\"CVE-2024-26656\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.9\",\"matchCriteriaId\":\"18FE1EAE-C36C-49FC-A5E0-0A661CDC561E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2e13f88e01ae7e28a7e831bf5c2409c4748e0a60\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:11:00+00:00",
      "cve": "CVE-2024-26656",
      "id": "CVE-2024-26656",
      "initial_release_date": "2024-04-02T00:00:00+00:00",
      "product_status:fixed": "1209",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "59",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: use-after-free vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26656.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:13:31Z",
      "cve": "CVE-2024-26656",
      "id": "CVE-2024-26656",
      "initial_release_date": "2024-04-05T02:21:27Z",
      "product_status:known_affected": "415",
      "product_status:known_not_affected": "83",
      "product_status:recommended": "689",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26656",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26656.json",
      "version": "95"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:29:28.444Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26656\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-02T14:54:50.822759Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:38.674Z\"}}], \"cna\": {\"title\": \"drm/amdgpu: fix use-after-free bug\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggered via `DRM_IOCTL_AMDGPU_GEM_USERPTR` on a local AMD GPU device node (`/dev/dri/renderD*` or `card*`); there is no remote or adjacent-network path to `amdgpu_gem_userptr_ioctl()`.\\nAC:L - A single ioctl with a fully attacker-chosen `addr`/`size` (e.g. 0xffffffffffff0000 / 0x80000000) deterministically overflows the interval-tree range check and reaches the unbalanced `mmdrop()`; there is no race and no dependence on memory layout.\\nPR:L - The ioctl is flagged `DRM_RENDER_ALLOW`, so `drm_ioctl_permit()` waives `DRM_AUTH` for render clients \\u2014 any unprivileged local user or sandboxed app with an open render node (standard for desktop sessions, Android apps, and GPU-enabled containers) qualifies, with no capability check anywhere on the path.\\nUI:N - The attacker performs the entire sequence itself by opening the render node and issuing the ioctl; no victim action or cooperation is required.\\nS:U - The corruption stays within the kernel\u0027s own security authority \\u2014 the calling process\u0027s `mm_struct` and mmu-notifier tree \\u2014 with no crossing of a VM, IOMMU, or hypervisor boundary.\\nC:H - The unbalanced `mmdrop()` frees the live `mm_struct` and its PGD while still in use; reclaiming those objects yields page-table control and therefore arbitrary kernel and cross-process memory disclosure.\\nI:H - The same use-after-free plus the `interval_tree_remove()` of a never-inserted node give heap-spray-controlled write primitives \\u2014 freeing an in-use PGD allows forging page-table entries for arbitrary memory modification and privilege escalation.\\nA:H - The path hits a `WARN_ON` (immediate panic under `panic_on_warn`), corrupts the mm\u0027s notifier interval tree, and tears down the running process\u0027s page tables, reliably crashing the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"2e13f88e01ae7e28a7e831bf5c2409c4748e0a60\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"e87e08c94c9541b4e18c4c13f2f605935f512605\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"af054a5fb24a144f99895afce9519d709891894c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"22f665ecfd1225afa1309ace623157d12bb9bb0c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"22207fd5c80177b860279653d017474b2812af5e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.132\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2e13f88e01ae7e28a7e831bf5c2409c4748e0a60\"}, {\"url\": \"https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605\"}, {\"url\": \"https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c\"}, {\"url\": \"https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c\"}, {\"url\": \"https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: fix use-after-free bug\\n\\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\\nFor example the following code:\\n\\nstatic void Syzkaller1(int fd)\\n{\\n\\tstruct drm_amdgpu_gem_userptr arg;\\n\\tint ret;\\n\\n\\targ.addr = 0xffffffffffff0000;\\n\\targ.size = 0x80000000; /*2 Gb*/\\n\\targ.flags = 0x7;\\n\\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\\n}\\n\\nDue to the address and size are not valid there is a failure in\\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\\nThe following stack is below when the issue is reproduced when Kazan is enabled:\\n\\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\\n[  +0.000010] Call Trace:\\n[  +0.000006]  \u003cTASK\u003e\\n[  +0.000007]  ? show_regs+0x6a/0x80\\n[  +0.000018]  ? __warn+0xa5/0x1b0\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000018]  ? report_bug+0x24a/0x290\\n[  +0.000022]  ? handle_bug+0x46/0x90\\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.132\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:34.438Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26656\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:34.438Z\", \"dateReserved\": \"2024-02-19T14:20:24.145Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T06:08:43.558Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.