CVE-2024-26911

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.190Z", "datePublished": "2024-04-17T15:59:22.597Z", "dateUpdated": "2026-08-05T11:28:15.941Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:15.941Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable allocator is reached only through DRM ioctls on a local device node (`/dev/dri/renderD128` or the primary node's dumb-buffer ioctl); there is no network-facing path to drm_buddy. Exploitation requires local code execution on the machine.\nAC:L - The attacker fully controls the inputs that drive the bug \u2014 allocation size and VRAM fragmentation \u2014 via repeated GEM create/destroy and CS submissions, so steering `__alloc_contig_try_harder()` to a free block whose RHS range overruns `mm->size` (or whose LHS offset underflows) is deterministic grooming, not a race or a condition outside their control.\nPR:L - An unprivileged local user with render-node access can trigger it; on typical desktop distros `/dev/dri/renderD128` is world-accessible, and GPU-accelerated containers, Android apps and ChromeOS sandboxes are granted it. `AMDGPU_GEM_CREATE`, `AMDGPU_CS`, `AMDGPU_GEM_VA` and `DRM_IOCTL_MODE_CREATE_DUMB` require no capability.\nUI:N - The attacker performs the allocations from their own process and consumes the resulting undersized buffer object themselves; no action by any other user is needed.\nS:U - The mis-sized allocation, the type-confused block, and the resulting VRAM accesses all remain under the kernel's own security authority \u2014 this is standard in-kernel memory corruption, not a VM escape or IOMMU boundary bypass.\nC:H - The buffer's tail is backed by VRAM belonging to other GPU clients, the scanout framebuffer, or kernel BOs, and the cursor overrun yields an attacker-influenced out-of-bounds VRAM offset; the attacker reads that memory via GPU shaders, CPU mmap of the BO, or dma-buf export \u2014 the reported \"display corruption\" is other buffers' contents being surfaced.\nI:H - The same aliased and out-of-bounds VRAM is writable through the attacker's GPU commands and CPU mappings, corrupting other clients' buffers; via `amdgpu_vm_pt_create()` a short-backed GPU page-table BO lets PTE writes land outside their allocation, giving control over GPU virtual address translations.\nA:H - The overrun hits `BUG_ON(start + size > res->size)` in `amdgpu_res_first()` and `BUG_ON(size > cur->remaining)` in `amdgpu_res_next()`, and the bogus block order (up to 63) drives absurd mapping sizes causing GPU page faults, GPU resets and hangs \u2014 all trivially repeatable by an unprivileged process."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "versions": [{"version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2", "status": "affected", "versionType": "git"}, {"version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}], "title": "drm/buddy: Fix alloc_range() error handling code", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T19:09:43.602719Z", "id": "CVE-2024-26911", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:09:57.405Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.625Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.625Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T19:09:43.602719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:09:51.244Z"}}], "cna": {"title": "drm/buddy: Fix alloc_range() error handling code", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable allocator is reached only through DRM ioctls on a local device node (`/dev/dri/renderD128` or the primary node's dumb-buffer ioctl); there is no network-facing path to drm_buddy. Exploitation requires local code execution on the machine.\nAC:L - The attacker fully controls the inputs that drive the bug \u2014 allocation size and VRAM fragmentation \u2014 via repeated GEM create/destroy and CS submissions, so steering `__alloc_contig_try_harder()` to a free block whose RHS range overruns `mm->size` (or whose LHS offset underflows) is deterministic grooming, not a race or a condition outside their control.\nPR:L - An unprivileged local user with render-node access can trigger it; on typical desktop distros `/dev/dri/renderD128` is world-accessible, and GPU-accelerated containers, Android apps and ChromeOS sandboxes are granted it. `AMDGPU_GEM_CREATE`, `AMDGPU_CS`, `AMDGPU_GEM_VA` and `DRM_IOCTL_MODE_CREATE_DUMB` require no capability.\nUI:N - The attacker performs the allocations from their own process and consumes the resulting undersized buffer object themselves; no action by any other user is needed.\nS:U - The mis-sized allocation, the type-confused block, and the resulting VRAM accesses all remain under the kernel's own security authority \u2014 this is standard in-kernel memory corruption, not a VM escape or IOMMU boundary bypass.\nC:H - The buffer's tail is backed by VRAM belonging to other GPU clients, the scanout framebuffer, or kernel BOs, and the cursor overrun yields an attacker-influenced out-of-bounds VRAM offset; the attacker reads that memory via GPU shaders, CPU mmap of the BO, or dma-buf export \u2014 the reported \"display corruption\" is other buffers' contents being surfaced.\nI:H - The same aliased and out-of-bounds VRAM is writable through the attacker's GPU commands and CPU mappings, corrupting other clients' buffers; via `amdgpu_vm_pt_create()` a short-backed GPU page-table BO lets PTE writes land outside their allocation, giving control over GPU virtual address translations.\nA:H - The overrun hits `BUG_ON(start + size > res->size)` in `amdgpu_res_first()` and `BUG_ON(size > cur->remaining)` in `amdgpu_res_next()`, and the bogus block order (up to 63) drives absurd mapping sizes causing GPU page faults, GPU resets and hangs \u2014 all trivially repeatable by an unprivileged process."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2", "versionType": "git"}, {"status": "affected", "version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:15.941Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26911", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:28:15.941Z", "dateReserved": "2024-02-19T14:20:24.190Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T15:59:22.597Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2", "status": "affected", "version": "0a1844bf0b532d84324453374ad6845f64066c28", "versionType": "git"}, {"lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "status": "affected", "version": "0a1844bf0b532d84324453374ad6845f64066c28", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABAABB52-E12B-4FA5-9F6F-94F0E111832F", "versionEndExcluding": "6.7.6", "versionStartExcluding": "6.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/buddy: corrige el c\u00f3digo de manejo de errores alloc_range() Pocos usuarios han observado da\u00f1os en la pantalla cuando inician la m\u00e1quina en KDE Plasma o juegan juegos. Hemos causado el problema de que cada vez que alloc_range() no pod\u00eda encontrar los bloques de memoria requeridos, la funci\u00f3n devolv\u00eda \u00c9XITO en algunos de los casos de esquina. El enfoque correcto ser\u00eda que si el tama\u00f1o total asignado es menor que el tama\u00f1o requerido, la funci\u00f3n deber\u00eda devolver -ENOSPC."}], "id": "CVE-2024-26911", "lastModified": "2026-08-04T11:17:20.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26911", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-17T19:09:43.602719Z", "version": "2.0.3"}}]}, "published": "2024-04-17T16:15:07.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/buddy: Fix alloc_range() error handling code", "id": "2275798", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275798"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/buddy: Fix alloc_range() error handling code\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."], "name": "CVE-2024-26911", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26911\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26911\nhttps://lore.kernel.org/linux-cve-announce/2024041736-CVE-2024-26911-e758@gregkh/T"], "statement": "No Red hat Products are affected by this vulnerability.", "threat_severity": "Moderate"}

{}