CVE-2024-58091 (GCVE-0-2024-58091)
Vulnerability from cvelistv5
Published
2025-03-27 14:57
Modified
2026-08-05 11:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed by struct page, so we cannot rely on it for deferred I/O. Allocate a shadow buffer for drivers that require deferred I/O and use it as framebuffer memory. Fixes driver errors about being "Unable to handle kernel NULL pointer dereference at virtual address" or "Unable to handle kernel paging request at virtual address". The patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial allocation, which creates the DMA-backed buffer object, and a tail that sets up the fbdev data structures. There is a tail function for direct memory mappings and a tail function for deferred I/O with the shadow buffer. It is no longer possible to use deferred I/O without shadow buffer. It can be re-added if there exists a reliably test for usable struct page in the allocated DMA-backed buffer object.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48
Version: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48
Version: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fbdev_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d087de947babf7ed70029d042abcc6ed06ff415",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            },
            {
              "lessThan": "cdc581169942de3b9e2648cfbd98c5ff9111c2c8",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            },
            {
              "lessThan": "3603996432997f7c88da37a97062a46cda01ac9d",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fbdev_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fbdev-dma: Add shadow buffering for deferred I/O\n\nDMA areas are not necessarily backed by struct page, so we cannot\nrely on it for deferred I/O. Allocate a shadow buffer for drivers\nthat require deferred I/O and use it as framebuffer memory.\n\nFixes driver errors about being \"Unable to handle kernel NULL pointer\ndereference at virtual address\" or \"Unable to handle kernel paging\nrequest at virtual address\".\n\nThe patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial\nallocation, which creates the DMA-backed buffer object, and a tail\nthat sets up the fbdev data structures. There is a tail function for\ndirect memory mappings and a tail function for deferred I/O with\nthe shadow buffer.\n\nIt is no longer possible to use deferred I/O without shadow buffer.\nIt can be re-added if there exists a reliably test for usable struct\npage in the allocated DMA-backed buffer object."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening and mmap()ing the local `/dev/fb0` character device; there is no remote or adjacent-network path to the fbdev deferred-I/O fault handler.\nAC:L - On an affected system the attacker simply mmaps the framebuffer and touches the mapping, deterministically entering `fb_deferred_io_fault()` with a non-struct-page DMA address; no race or uncontrollable precondition is involved.\nPR:L - `fb_open()`/`fb_mmap()` perform no capability checks \u2014 only `/dev/fb0` file permissions apply, and on the embedded/Raspberry Pi-class systems running the affected SPI-panel and LCDC drivers the ordinary console user is in the `video` group.\nUI:N - The attacker performs the mmap and the write to its own mapping; no action by another user or administrator is needed.\nS:U - The corruption and crash occur within the kernel of the same machine and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The fault handler hands a fabricated `struct page` (from an unbacked physical frame) to the VM layer and installs it in the attacker\u0027s page tables, so mismanaged/aliased page metadata can expose kernel-owned or reserved physical memory contents to userspace.\nI:H - Before crashing, the path writes through the bogus page pointer \u2014 refcount increment, `page-\u003emapping`, `page-\u003eindex` set to the attacker-controlled `pgoff`, and `PG_locked` \u2014 and the fake page can later be released into the buddy allocator, giving page-metadata corruption that is leverageable for further memory corruption.\nA:H - The documented and reproducible outcome is an immediate kernel oops (\"Unable to handle kernel NULL pointer dereference\"/\"Unable to handle kernel paging request\"), a full denial of service triggerable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:40.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d087de947babf7ed70029d042abcc6ed06ff415"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdc581169942de3b9e2648cfbd98c5ff9111c2c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3603996432997f7c88da37a97062a46cda01ac9d"
        }
      ],
      "title": "drm/fbdev-dma: Add shadow buffering for deferred I/O",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58091",
    "datePublished": "2025-03-27T14:57:03.560Z",
    "dateReserved": "2025-03-06T15:52:09.188Z",
    "dateUpdated": "2026-08-05T11:47:40.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.