CVE-2024-32936 (GCVE-0-2024-32936)

Vulnerability from cvelistv5 – Published: 2024-06-24 13:56 – Updated: 2026-08-05 11:29
VLAI
Title
media: ti: j721e-csi2rx: Fix races while restarting DMA
Summary
In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to DMA, it may happen that the submitted list is not updated soon enough, and the DMA callback is triggered before that. This can lead to kernel crashes, so move everything in a single lock/unlock section to prevent such races.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b4a3d877dc92963a4db16ddb71df3d333c0d40bd , < 80a8b92950f8ee96582dba6187e3c2deca3569ea (git)
Affected: b4a3d877dc92963a4db16ddb71df3d333c0d40bd , < ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.9.4 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:27:52.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32936",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:08:40.067111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:43.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "80a8b92950f8ee96582dba6187e3c2deca3569ea",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            },
            {
              "lessThan": "ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\n\nAfter the frame is submitted to DMA, it may happen that the submitted\nlist is not updated soon enough, and the DMA callback is triggered\nbefore that.\n\nThis can lead to kernel crashes, so move everything in a single\nlock/unlock section to prevent such races."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered exclusively through `VIDIOC_QBUF` ioctls on the `/dev/videoN` node exported by the j721e-csi2rx capture driver, requiring local system access. No network or physical access is involved.\nAC:L - The attacker creates and controls both sides of the race: buffer starvation is induced at will by withholding QBUF until `dma-\u003estate` becomes `TI_CSI2RX_DMA_IDLE`, and the QBUF that reopens the unlocked window is issued at a chosen instant, repeatable every frame period with unlimited retries; the DMA completion fires promptly because the PSI-L endpoint is already backed up in exactly this stalled state.\nPR:L - Only an unprivileged local account with access to the V4L2 device node is needed \u2014 `v4l2_fh_open` and the vb2 qbuf path perform no capability checks whatsoever. On the affected J721e/AM62 embedded and automotive platforms this is an ordinary camera-capable application user.\nUI:N - The attacking process drives the entire sequence itself via REQBUFS/STREAMON/QBUF; no action by any other user or victim is required.\nS:U - The corruption is confined to kernel heap objects (vb2 buffer structures and the driver\u0027s DMA lists) within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `list_del()` on an unlinked buffer plus double-ownership of vb2 buffers between the driver and userspace yields heap corruption over groomable `kmalloc-2k` objects, which can be leveraged to read adjacent kernel memory; the premature `vb2_buffer_done()` also exposes DMA-target contents to userspace out of sequence.\nI:H - `__list_del()` writes `next-\u003eprev`/`prev-\u003enext` through stale or poisoned pointers on the buffer\u0027s `list_head`, and the doubly-owned buffer allows a second `list_add_tail()` cross-linking `dma-\u003equeue` and `dma-\u003esubmitted` \u2014 a classic list-corruption write primitive suitable for control-flow hijack.\nA:H - The commit explicitly states the race \"can lead to kernel crashes,\" and the sibling fix for the same callback documents `kernel BUG at lib/list_debug.c:65` escalating to \"Kernel panic - not syncing: Fatal exception in interrupt\" because the corruption occurs in softirq context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:49.671Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b"
        }
      ],
      "title": "media: ti: j721e-csi2rx: Fix races while restarting DMA",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-32936",
    "datePublished": "2024-06-24T13:56:48.054Z",
    "dateReserved": "2024-06-24T13:54:11.064Z",
    "dateUpdated": "2026-08-05T11:29:49.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-32936",
      "date": "2026-08-09",
      "epss": "0.00146",
      "percentile": "0.0436"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\\n\\nAfter the frame is submitted to DMA, it may happen that the submitted\\nlist is not updated soon enough, and the DMA callback is triggered\\nbefore that.\\n\\nThis can lead to kernel crashes, so move everything in a single\\nlock/unlock section to prevent such races.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: media: ti: j721e-csi2rx: corrige ejecuciones al reiniciar DMA Despu\\u00e9s de que el marco se env\\u00eda a DMA, puede suceder que la lista enviada no se actualice lo suficientemente pronto y la devoluci\\u00f3n de llamada de DMA se activa antes de eso. Esto puede provocar fallos del kernel, as\\u00ed que mueva todo a una \\u00fanica secci\\u00f3n de bloqueo/desbloqueo para evitar este tipo de ejecuciones.\"}]",
      "id": "CVE-2024-32936",
      "lastModified": "2024-11-21T09:16:04.560",
      "published": "2024-06-24T14:15:11.600",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-32936\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-24T14:15:11.600\",\"lastModified\":\"2026-08-04T11:17:50.550\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\\n\\nAfter the frame is submitted to DMA, it may happen that the submitted\\nlist is not updated soon enough, and the DMA callback is triggered\\nbefore that.\\n\\nThis can lead to kernel crashes, so move everything in a single\\nlock/unlock section to prevent such races.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: media: ti: j721e-csi2rx: corrige ejecuciones al reiniciar DMA Despu\u00e9s de que el marco se env\u00eda a DMA, puede suceder que la lista enviada no se actualice lo suficientemente pronto y la devoluci\u00f3n de llamada de DMA se activa antes de eso. Esto puede provocar fallos del kernel, as\u00ed que mueva todo a una \u00fanica secci\u00f3n de bloqueo/desbloqueo para evitar este tipo de ejecuciones.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\",\"lessThan\":\"80a8b92950f8ee96582dba6187e3c2deca3569ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\",\"lessThan\":\"ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.4\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:08:40.067111Z\",\"id\":\"CVE-2024-32936\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.4\",\"matchCriteriaId\":\"991B9791-966A-4D18-9E8D-A8AB128E5627\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:48:04+00:00",
      "cve": "CVE-2024-32936",
      "id": "CVE-2024-32936",
      "initial_release_date": "2024-06-24T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: ti: j721e-csi2rx: Fix races while restarting DMA",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-32936.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:51:58Z",
      "cve": "CVE-2024-32936",
      "id": "CVE-2024-32936",
      "initial_release_date": "2024-06-24T23:18:53Z",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-32936",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-32936.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:27:52.128Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-32936\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:08:40.067111Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.407Z\"}}], \"cna\": {\"title\": \"media: ti: j721e-csi2rx: Fix races while restarting DMA\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is entered exclusively through `VIDIOC_QBUF` ioctls on the `/dev/videoN` node exported by the j721e-csi2rx capture driver, requiring local system access. No network or physical access is involved.\\nAC:L - The attacker creates and controls both sides of the race: buffer starvation is induced at will by withholding QBUF until `dma-\u003estate` becomes `TI_CSI2RX_DMA_IDLE`, and the QBUF that reopens the unlocked window is issued at a chosen instant, repeatable every frame period with unlimited retries; the DMA completion fires promptly because the PSI-L endpoint is already backed up in exactly this stalled state.\\nPR:L - Only an unprivileged local account with access to the V4L2 device node is needed \\u2014 `v4l2_fh_open` and the vb2 qbuf path perform no capability checks whatsoever. On the affected J721e/AM62 embedded and automotive platforms this is an ordinary camera-capable application user.\\nUI:N - The attacking process drives the entire sequence itself via REQBUFS/STREAMON/QBUF; no action by any other user or victim is required.\\nS:U - The corruption is confined to kernel heap objects (vb2 buffer structures and the driver\u0027s DMA lists) within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `list_del()` on an unlinked buffer plus double-ownership of vb2 buffers between the driver and userspace yields heap corruption over groomable `kmalloc-2k` objects, which can be leveraged to read adjacent kernel memory; the premature `vb2_buffer_done()` also exposes DMA-target contents to userspace out of sequence.\\nI:H - `__list_del()` writes `next-\u003eprev`/`prev-\u003enext` through stale or poisoned pointers on the buffer\u0027s `list_head`, and the doubly-owned buffer allows a second `list_add_tail()` cross-linking `dma-\u003equeue` and `dma-\u003esubmitted` \\u2014 a classic list-corruption write primitive suitable for control-flow hijack.\\nA:H - The commit explicitly states the race \\\"can lead to kernel crashes,\\\" and the sibling fix for the same callback documents `kernel BUG at lib/list_debug.c:65` escalating to \\\"Kernel panic - not syncing: Fatal exception in interrupt\\\" because the corruption occurs in softirq context.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\", \"lessThan\": \"80a8b92950f8ee96582dba6187e3c2deca3569ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\", \"lessThan\": \"ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\"}, {\"url\": \"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\\n\\nAfter the frame is submitted to DMA, it may happen that the submitted\\nlist is not updated soon enough, and the DMA callback is triggered\\nbefore that.\\n\\nThis can lead to kernel crashes, so move everything in a single\\nlock/unlock section to prevent such races.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.4\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:49.671Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-32936\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:49.671Z\", \"dateReserved\": \"2024-06-24T13:54:11.064Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-24T13:56:48.054Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.