CVE-2024-27408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-27408", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:47:42.682Z", "datePublished": "2024-05-17T11:50:36.208Z", "dateUpdated": "2026-10-30T12:18:13.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:13.788Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable sequence is reached only through the local dmaengine client API (`dma_async_issue_pending()` \u2192 `dw_edma_device_issue_pending()` \u2192 `dw_edma_v0_core_start()`), i.e. via a device node or in-kernel client on the host driving the remote eDMA. There is no network- or packet-facing path into drivers/dma/dw-edma/.\nAC:L - An attacker able to submit transfers can repeat them indefinitely at no cost and can widen the window at will by building large scatter-gather lists, since every chunk re-writes the LL and rings the doorbell again \u2014 and per the commit, on affected remote setups the unordered doorbell simply races the LL writes rather than requiring an unusual condition.\nPR:L - No capability check exists on the path \u2014 the dmaengine core imposes none, so an unprivileged local account with ordinary access to a client device node backed by these eDMA channels is sufficient to issue the transfers that ring the doorbell.\nUI:N - The attacker drives the entire submit/complete cycle on its own; no action by another user or administrator is needed, and an already-bound dw-edma-pcie device is system configuration rather than victim interaction.\nS:U - The corrupted transfers act on host memory already within the DMA mapping the kernel authorized for this device, all under the same kernel security authority; no IOMMU, VM, or sandbox boundary is bypassed.\nC:H - A torn descriptor makes the engine read from the previous chunk's SAR while writing to the new DAR, and a not-yet-landed LLP terminator lets it walk past the LL region and follow arbitrary BAR contents as descriptors, so effectively arbitrary host memory can be sourced and shipped to the remote endpoint or into a buffer the attacker reads back.\nI:H - The same stale or run-away descriptors give the PCIe engine a write with attacker-influenceable destination and length into host kernel-mapped memory \u2014 a memory-corruption write primitive, not merely wrong data in the intended buffer.\nA:H - DMA into unintended kernel memory reliably produces corruption and oops/panic, and the malformed descriptor walk also raises linked-list errors and abort interrupts that stall the channel and hang clients waiting on completion."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/dw-edma/dw-edma-v0-core.c"], "versions": [{"version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "85cb0ca8efa483e5d22385ea12fc5857c48a0904", "status": "affected", "versionType": "git"}, {"version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3", "status": "affected", "versionType": "git"}, {"version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "f396b4df27cfe01a99f4b41f584c49e56477be3a", "status": "affected", "versionType": "git"}, {"version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "bbcc1c83f343e580c3aa1f2a8593343bf7b55bba", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/dw-edma/dw-edma-v0-core.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.7.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/85cb0ca8efa483e5d22385ea12fc5857c48a0904"}, {"url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3"}, {"url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a"}, {"url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba"}], "title": "dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T16:00:32.783313Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:46:41.685Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.272Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.272Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T16:00:32.783313Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.225Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable sequence is reached only through the local dmaengine client API (`dma_async_issue_pending()` \u2192 `dw_edma_device_issue_pending()` \u2192 `dw_edma_v0_core_start()`), i.e. via a device node or in-kernel client on the host driving the remote eDMA. There is no network- or packet-facing path into drivers/dma/dw-edma/.\nAC:L - An attacker able to submit transfers can repeat them indefinitely at no cost and can widen the window at will by building large scatter-gather lists, since every chunk re-writes the LL and rings the doorbell again \u2014 and per the commit, on affected remote setups the unordered doorbell simply races the LL writes rather than requiring an unusual condition.\nPR:L - No capability check exists on the path \u2014 the dmaengine core imposes none, so an unprivileged local account with ordinary access to a client device node backed by these eDMA channels is sufficient to issue the transfers that ring the doorbell.\nUI:N - The attacker drives the entire submit/complete cycle on its own; no action by another user or administrator is needed, and an already-bound dw-edma-pcie device is system configuration rather than victim interaction.\nS:U - The corrupted transfers act on host memory already within the DMA mapping the kernel authorized for this device, all under the same kernel security authority; no IOMMU, VM, or sandbox boundary is bypassed.\nC:H - A torn descriptor makes the engine read from the previous chunk's SAR while writing to the new DAR, and a not-yet-landed LLP terminator lets it walk past the LL region and follow arbitrary BAR contents as descriptors, so effectively arbitrary host memory can be sourced and shipped to the remote endpoint or into a buffer the attacker reads back.\nI:H - The same stale or run-away descriptors give the PCIe engine a write with attacker-influenceable destination and length into host kernel-mapped memory \u2014 a memory-corruption write primitive, not merely wrong data in the intended buffer.\nA:H - DMA into unintended kernel memory reliably produces corruption and oops/panic, and the malformed descriptor walk also raises linked-list errors and abort interrupts that stall the channel and hang clients waiting on completion."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "85cb0ca8efa483e5d22385ea12fc5857c48a0904", "versionType": "git"}, {"status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3", "versionType": "git"}, {"status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "f396b4df27cfe01a99f4b41f584c49e56477be3a", "versionType": "git"}, {"status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "lessThan": "bbcc1c83f343e580c3aa1f2a8593343bf7b55bba", "versionType": "git"}], "programFiles": ["drivers/dma/dw-edma/dw-edma-v0-core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.21", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.9", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/dma/dw-edma/dw-edma-v0-core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/85cb0ca8efa483e5d22385ea12fc5857c48a0904"}, {"url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3"}, {"url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a"}, {"url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.21", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.9", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:13.788Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27408", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:18:13.788Z", "dateReserved": "2024-02-25T13:47:42.682Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T11:50:36.208Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/dw-edma/dw-edma-v0-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "85cb0ca8efa483e5d22385ea12fc5857c48a0904", "status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "versionType": "git"}, {"lessThan": "d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3", "status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "versionType": "git"}, {"lessThan": "f396b4df27cfe01a99f4b41f584c49e56477be3a", "status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "versionType": "git"}, {"lessThan": "bbcc1c83f343e580c3aa1f2a8593343bf7b55bba", "status": "affected", "version": "7e4b8a4fbe2cecab0959e862604803d063f50029", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/dw-edma/dw-edma-v0-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3220B3B1-12D7-47E1-8AF9-CBF0B6529FE9", "versionEndExcluding": "6.6.21", "versionStartIncluding": "5.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C538467-EDA0-4A9A-82EB-2925DE9FF827", "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: dmaengine: dw-edma: eDMA: A\u00f1adida lectura sincronizada antes de iniciar la transferencia DMA en la configuraci\u00f3n remota. El elemento de la lista vinculada y el puntero no se almacenan en la misma memoria que el registro del controlador eDMA. Si el registro del timbre se activa antes de la escritura completa de la lista vinculada, se producir\u00e1 un error de condici\u00f3n de ejecuci\u00f3n. En la configuraci\u00f3n remota, solo podemos usar una lectura en la memoria para asegurarnos de que se haya producido la escritura completa."}], "id": "CVE-2024-27408", "lastModified": "2026-10-30T13:17:26.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27408", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-21T16:00:32.783313Z", "version": "2.0.3"}}]}, "published": "2024-05-17T12:15:11.223", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/85cb0ca8efa483e5d22385ea12fc5857c48a0904"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup", "id": "2281117", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281117"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred."], "name": "CVE-2024-27408", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27408\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27408\nhttps://lore.kernel.org/linux-cve-announce/2024051700-CVE-2024-27408-6911@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-12T22:23:12.648855+00:00", "updated": "2025-07-12T22:23:12.648912+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}