CVE-2024-26699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26699", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.157Z", "datePublished": "2024-04-03T14:54:59.268Z", "dateUpdated": "2026-08-05T11:26:46.401Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:46.401Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is in the amdgpu DC clock-manager initialization path (`dcn35_clk_mgr_construct`), reached only via local driver init/probe on a DCN35 APU; there is no network, adjacent-network, or removable-device path to it. Local system access to the GPU device is what is needed, so Local is the correct and highest defensible vector.\nAC:L - There is no race and no dependency on unpredictable memory layout \u2014 on an affected DCN35 system whose PMFW reports level counts above the driver's array sizes, the unbounded loops overflow deterministically on every driver initialization. Per the higher-severity rule this is Low rather than High.\nPR:L - The overflow executes in the driver-init path with no credential or capability check of its own, and requires only local access to the amdgpu device rather than verified root in the initial namespace. This matches the established scoring for amdgpu display driver bugs in this subsystem.\nUI:N - The vulnerable helper runs unconditionally during display-core construction (`pstate_enabled` defaults to true for DCN35) with no victim action such as opening a file or plugging in a device. No user interaction is involved.\nS:U - The out-of-bounds read and write both stay within the kernel's own memory and the driver's DMA buffer, corrupting kernel data structures managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `MemPstateTable[]`, `FclkClocks_Freq[]`, `DcfClocks[]` and `SocClocks[]` are read far past their bounds \u2014 up to ~4 KB beyond the single-page VRAM buffer \u2014 and the resulting adjacent memory contents are propagated into `bw_params->clk_table.entries[]`, which is surfaced through DC logging and clock reporting. This is an unbounded OOB read leveraged for information disclosure.\nI:H - `bw_params->clk_table.entries[i]` is written for `i` bounded only by an attacker/firmware-supplied `uint8_t`, against an 8-element array, giving an out-of-bounds write of up to ~10 KB of partly firmware-controlled data past the static `dcn35_bw_params` global into adjacent kernel `.data`. Such adjacent-global corruption is exploitable for control-flow or state manipulation.\nA:H - The OOB read walks off the end of the one-page VRAM BO mapping and the OOB write smashes neighbouring kernel globals, producing oops/panic or a corrupted display clock state at boot. Any kernel crash of this kind is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"], "versions": [{"version": "8774029f76b9806f2f3586bb0502408076767fd5", "lessThan": "ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb", "status": "affected", "versionType": "git"}, {"version": "8774029f76b9806f2f3586bb0502408076767fd5", "lessThan": "46806e59a87790760870d216f54951a5b4d545bc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"}, {"url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"}], "title": "drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.940Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:52:47.122143Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:29.383Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.940Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:52:47.122143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:16.947Z"}}], "cna": {"title": "drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is in the amdgpu DC clock-manager initialization path (`dcn35_clk_mgr_construct`), reached only via local driver init/probe on a DCN35 APU; there is no network, adjacent-network, or removable-device path to it. Local system access to the GPU device is what is needed, so Local is the correct and highest defensible vector.\nAC:L - There is no race and no dependency on unpredictable memory layout \u2014 on an affected DCN35 system whose PMFW reports level counts above the driver's array sizes, the unbounded loops overflow deterministically on every driver initialization. Per the higher-severity rule this is Low rather than High.\nPR:L - The overflow executes in the driver-init path with no credential or capability check of its own, and requires only local access to the amdgpu device rather than verified root in the initial namespace. This matches the established scoring for amdgpu display driver bugs in this subsystem.\nUI:N - The vulnerable helper runs unconditionally during display-core construction (`pstate_enabled` defaults to true for DCN35) with no victim action such as opening a file or plugging in a device. No user interaction is involved.\nS:U - The out-of-bounds read and write both stay within the kernel's own memory and the driver's DMA buffer, corrupting kernel data structures managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `MemPstateTable[]`, `FclkClocks_Freq[]`, `DcfClocks[]` and `SocClocks[]` are read far past their bounds \u2014 up to ~4 KB beyond the single-page VRAM buffer \u2014 and the resulting adjacent memory contents are propagated into `bw_params->clk_table.entries[]`, which is surfaced through DC logging and clock reporting. This is an unbounded OOB read leveraged for information disclosure.\nI:H - `bw_params->clk_table.entries[i]` is written for `i` bounded only by an attacker/firmware-supplied `uint8_t`, against an 8-element array, giving an out-of-bounds write of up to ~10 KB of partly firmware-controlled data past the static `dcn35_bw_params` global into adjacent kernel `.data`. Such adjacent-global corruption is exploitable for control-flow or state manipulation.\nA:H - The OOB read walks off the end of the one-page VRAM BO mapping and the OOB write smashes neighbouring kernel globals, producing oops/panic or a corrupted display clock state at boot. Any kernel crash of this kind is High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8774029f76b9806f2f3586bb0502408076767fd5", "lessThan": "ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb", "versionType": "git"}, {"status": "affected", "version": "8774029f76b9806f2f3586bb0502408076767fd5", "lessThan": "46806e59a87790760870d216f54951a5b4d545bc", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"}, {"url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:46.401Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26699", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:46.401Z", "dateReserved": "2024-02-19T14:20:24.157Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-03T14:54:59.268Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb", "status": "affected", "version": "8774029f76b9806f2f3586bb0502408076767fd5", "versionType": "git"}, {"lessThan": "46806e59a87790760870d216f54951a5b4d545bc", "status": "affected", "version": "8774029f76b9806f2f3586bb0502408076767fd5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "73A68EB5-7019-4CD5-81D0-D69C4FD854FA", "versionEndExcluding": "6.7.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amd/display: corrige el \u00edndice de matriz fuera de los l\u00edmites en dcn35_clkmgr [Por qu\u00e9] Existe una posible infracci\u00f3n de acceso a la memoria al iterar a trav\u00e9s de una matriz de clks dcn35. [C\u00f3mo] Limitar la iteraci\u00f3n por tama\u00f1o de matriz."}], "id": "CVE-2024-26699", "lastModified": "2026-08-04T11:16:57.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26699", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:52:47.122143Z", "version": "2.0.3"}}]}, "published": "2024-04-03T15:15:52.980", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr", "id": "2273115", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273115"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n[How]\nLimit iteration per array size."], "name": "CVE-2024-26699", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26699\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26699\nhttps://lore.kernel.org/linux-cve-announce/2024040339-CVE-2024-26699-c700@gregkh/T"], "threat_severity": "Low"}

{}