CVE-2024-44994

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-44994", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.672Z", "datePublished": "2024-09-04T19:54:40.214Z", "dateUpdated": "2026-08-05T11:37:33.085Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:33.085Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Restore lost return in iommu_report_device_fault()\n\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\n\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\n\nDeleting the return was a typo, put it back."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control \u2014 an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device's page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\nPR:L - Only access to an SVA/PASID-capable device node is needed \u2014 idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads \u2014 or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\nUI:N - The fault is generated by the attacker's own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU's device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` \u2014 still reachable via `dev->iommu->fault_param` and `queue->devices` \u2014 give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops->page_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\nA:H - The commit itself states the fall-through results in \"an eventual crash\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/io-pgfault.c"], "versions": [{"version": "3dfa64aecbafc288216b2790438d395add192c30", "lessThan": "cc6bc2ab1663ec9353636416af22452b078510e9", "status": "affected", "versionType": "git"}, {"version": "3dfa64aecbafc288216b2790438d395add192c30", "lessThan": "fca5b78511e98bdff2cdd55c172b23200a7b3404", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/io-pgfault.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.7", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9"}, {"url": "https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404"}], "title": "iommu: Restore lost return in iommu_report_device_fault()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-04T20:19:24.535460Z", "id": "CVE-2024-44994", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:19:36.614Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-44994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-04T20:19:24.535460Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:19:26.964Z"}}], "cna": {"title": "iommu: Restore lost return in iommu_report_device_fault()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control \u2014 an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device's page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\nPR:L - Only access to an SVA/PASID-capable device node is needed \u2014 idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads \u2014 or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\nUI:N - The fault is generated by the attacker's own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU's device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` \u2014 still reachable via `dev->iommu->fault_param` and `queue->devices` \u2014 give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops->page_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\nA:H - The commit itself states the fall-through results in \"an eventual crash\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3dfa64aecbafc288216b2790438d395add192c30", "lessThan": "cc6bc2ab1663ec9353636416af22452b078510e9", "versionType": "git"}, {"status": "affected", "version": "3dfa64aecbafc288216b2790438d395add192c30", "lessThan": "fca5b78511e98bdff2cdd55c172b23200a7b3404", "versionType": "git"}], "programFiles": ["drivers/iommu/io-pgfault.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.10.7", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/io-pgfault.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9"}, {"url": "https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Restore lost return in iommu_report_device_fault()\n\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\n\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\n\nDeleting the return was a typo, put it back."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.7", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "6.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:33.085Z"}}}, "cveMetadata": {"cveId": "CVE-2024-44994", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:37:33.085Z", "dateReserved": "2024-08-21T05:34:56.672Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-04T19:54:40.214Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/io-pgfault.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc6bc2ab1663ec9353636416af22452b078510e9", "status": "affected", "version": "3dfa64aecbafc288216b2790438d395add192c30", "versionType": "git"}, {"lessThan": "fca5b78511e98bdff2cdd55c172b23200a7b3404", "status": "affected", "version": "3dfa64aecbafc288216b2790438d395add192c30", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/io-pgfault.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E94ACAFB-7FD4-4D6C-B1EF-5ACFEF7D85D6", "versionEndExcluding": "6.10.7", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Restore lost return in iommu_report_device_fault()\n\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\n\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\n\nDeleting the return was a typo, put it back."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu: Restaurar retorno perdido en iommu_report_device_fault() Cuando se llama a iommu_report_device_fault con un error parcial, se supone que debe recopilar el error en el grupo y luego regresar. En cambio, el retorno se elimin\u00f3 accidentalmente, lo que da como resultado el intento de procesar el error y un bloqueo final. Eliminar el retorno fue un error tipogr\u00e1fico, vuelva a colocarlo."}], "id": "CVE-2024-44994", "lastModified": "2026-08-04T11:20:08.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-44994", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-04T20:19:24.535460Z", "version": "2.0.3"}}]}, "published": "2024-09-04T20:15:08.307", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:10939", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.16.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10939", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.16.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-11T00:00:00Z"}], "bugzilla": {"description": "kernel: iommu: Restore lost return in iommu_report_device_fault()", "id": "2309857", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309857"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-703", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niommu: Restore lost return in iommu_report_device_fault()\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\nDeleting the return was a typo, put it back."], "name": "CVE-2024-44994", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-44994\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-44994\nhttps://lore.kernel.org/linux-cve-announce/2024090448-CVE-2024-44994-9c09@gregkh/T"], "threat_severity": "Moderate"}

{}