CVE-2024-50090

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-50090", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.942Z", "datePublished": "2024-11-05T17:04:54.546Z", "dateUpdated": "2026-08-05T11:41:34.890Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:34.890Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix overflow in oa batch buffer\n\nBy default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch\nbuffer, this is not a problem if batch buffer is only used once but\noa reuses the batch buffer for the same metric and at each call\nit appends a MI_BATCH_BUFFER_END, printing the warning below and then\noverflowing.\n\n[ 381.072016] ------------[ cut here ]------------\n[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!\n platform: LUNARLAKE subplatform: 1\n graphics: Xe2_LPG / Xe2_HPG 20.04 step B0\n media: Xe2_LPM / Xe2_HPM 20.00 step B0\n tile: 0 VRAM 0 B\n GT: 0 type 1\n\nSo here checking if batch buffer already have MI_BATCH_BUFFER_END if\nnot append it.\n\nv2:\n- simply fix, suggestion from Ashutosh\n\n(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the xe DRM render node (`/dev/dri/renderD*`) via the OA stream open ioctl followed by `DRM_XE_OBSERVATION_IOCTL_CONFIG` on the returned fd. This requires local access to the GPU device node; there is no remote or adjacent-network path.\nAC:L - Triggering is fully deterministic \u2014 the attacker opens one OA stream and loops the CONFIG ioctl alternating between two metric sets, with `bb->len` incrementing by exactly one dword per call, so the overflow offset is precisely attacker-chosen and no race or unknown memory layout is involved. CONFIG_DRM_XE is the default driver for all modern Intel graphics (Meteor Lake, Lunar Lake, DG2/Arc, Battlemage) in distro kernels.\nPR:L - Only an unprivileged local account with render-node access and an exec queue is needed: the query-sampling path sets `privileged_op = false` (`xe_oa.c:1826`), bypassing the `perfmon_capable()` gate at stream open, and `xe_oa_ioctl()`/`xe_oa_config_locked()` perform no capability check at all. Render nodes are world-accessible or render-group accessible on common distros and reachable by ordinary apps on Android/ChromeOS.\nUI:N - The attacker performs the entire sequence \u2014 open stream, loop the config ioctl \u2014 within their own process. No victim action is required.\nS:U - The out-of-bounds write and its consequences are confined to kernel memory managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The overflow writes into the shared 1 MB `kernel_bb_pool` holding live `xe_migrate` command streams; a stray MI_BATCH_BUFFER_END truncates a BO clear/copy batch, leaving stale memory contents exposed to another client, or corrupts a PTE-emitting batch so GPU page tables map arbitrary memory readable by attacker GPU work. On discrete GPUs the write lands in a `kvzalloc()`'d kernel heap buffer, giving OOB access to adjacent kernel objects.\nI:H - This is an unbounded out-of-bounds kernel write of a fixed dword (0x05000000) at an offset the attacker selects exactly by iteration count, hitting vmap'd BO pages on integrated GPUs and the kernel heap on discrete GPUs. It also rewrites GPU command streams that the engine executes with full GGTT access, making control-flow and page-table corruption achievable.\nA:H - The reported symptom is a driver assertion failure and buffer overflow; continued iteration corrupts in-flight kernel batch buffers causing GPU hangs and device wedging, and writing past the pool mapping produces a kernel oops/panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_bb.c"], "versions": [{"version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "bcb5be3421705e682b0b32073ad627056d6bc2a2", "status": "affected", "versionType": "git"}, {"version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "6c10ba06bb1b48acce6d4d9c1e33beb9954f1788", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_bb.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2"}, {"url": "https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788"}], "title": "drm/xe/oa: Fix overflow in oa batch buffer", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-18T15:56:39.428028Z", "id": "CVE-2024-50090", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T15:57:57.426Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-50090", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-18T15:56:39.428028Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T15:55:09.569Z"}}], "cna": {"title": "drm/xe/oa: Fix overflow in oa batch buffer", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the xe DRM render node (`/dev/dri/renderD*`) via the OA stream open ioctl followed by `DRM_XE_OBSERVATION_IOCTL_CONFIG` on the returned fd. This requires local access to the GPU device node; there is no remote or adjacent-network path.\nAC:L - Triggering is fully deterministic \u2014 the attacker opens one OA stream and loops the CONFIG ioctl alternating between two metric sets, with `bb->len` incrementing by exactly one dword per call, so the overflow offset is precisely attacker-chosen and no race or unknown memory layout is involved. CONFIG_DRM_XE is the default driver for all modern Intel graphics (Meteor Lake, Lunar Lake, DG2/Arc, Battlemage) in distro kernels.\nPR:L - Only an unprivileged local account with render-node access and an exec queue is needed: the query-sampling path sets `privileged_op = false` (`xe_oa.c:1826`), bypassing the `perfmon_capable()` gate at stream open, and `xe_oa_ioctl()`/`xe_oa_config_locked()` perform no capability check at all. Render nodes are world-accessible or render-group accessible on common distros and reachable by ordinary apps on Android/ChromeOS.\nUI:N - The attacker performs the entire sequence \u2014 open stream, loop the config ioctl \u2014 within their own process. No victim action is required.\nS:U - The out-of-bounds write and its consequences are confined to kernel memory managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The overflow writes into the shared 1 MB `kernel_bb_pool` holding live `xe_migrate` command streams; a stray MI_BATCH_BUFFER_END truncates a BO clear/copy batch, leaving stale memory contents exposed to another client, or corrupts a PTE-emitting batch so GPU page tables map arbitrary memory readable by attacker GPU work. On discrete GPUs the write lands in a `kvzalloc()`'d kernel heap buffer, giving OOB access to adjacent kernel objects.\nI:H - This is an unbounded out-of-bounds kernel write of a fixed dword (0x05000000) at an offset the attacker selects exactly by iteration count, hitting vmap'd BO pages on integrated GPUs and the kernel heap on discrete GPUs. It also rewrites GPU command streams that the engine executes with full GGTT access, making control-flow and page-table corruption achievable.\nA:H - The reported symptom is a driver assertion failure and buffer overflow; continued iteration corrupts in-flight kernel batch buffers causing GPU hangs and device wedging, and writing past the pool mapping produces a kernel oops/panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "bcb5be3421705e682b0b32073ad627056d6bc2a2", "versionType": "git"}, {"status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "6c10ba06bb1b48acce6d4d9c1e33beb9954f1788", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/xe/xe_bb.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.11.4", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_bb.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2"}, {"url": "https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix overflow in oa batch buffer\n\nBy default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch\nbuffer, this is not a problem if batch buffer is only used once but\noa reuses the batch buffer for the same metric and at each call\nit appends a MI_BATCH_BUFFER_END, printing the warning below and then\noverflowing.\n\n[ 381.072016] ------------[ cut here ]------------\n[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!\n platform: LUNARLAKE subplatform: 1\n graphics: Xe2_LPG / Xe2_HPG 20.04 step B0\n media: Xe2_LPM / Xe2_HPM 20.00 step B0\n tile: 0 VRAM 0 B\n GT: 0 type 1\n\nSo here checking if batch buffer already have MI_BATCH_BUFFER_END if\nnot append it.\n\nv2:\n- simply fix, suggestion from Ashutosh\n\n(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.4", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:34.890Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50090", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:41:34.890Z", "dateReserved": "2024-10-21T19:36:19.942Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-11-05T17:04:54.546Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_bb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bcb5be3421705e682b0b32073ad627056d6bc2a2", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git"}, {"lessThan": "6c10ba06bb1b48acce6d4d9c1e33beb9954f1788", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_bb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AAD11B17-DA3D-4375-B157-80D6011F6004", "versionEndExcluding": "6.11.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix overflow in oa batch buffer\n\nBy default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch\nbuffer, this is not a problem if batch buffer is only used once but\noa reuses the batch buffer for the same metric and at each call\nit appends a MI_BATCH_BUFFER_END, printing the warning below and then\noverflowing.\n\n[ 381.072016] ------------[ cut here ]------------\n[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!\n platform: LUNARLAKE subplatform: 1\n graphics: Xe2_LPG / Xe2_HPG 20.04 step B0\n media: Xe2_LPM / Xe2_HPM 20.00 step B0\n tile: 0 VRAM 0 B\n GT: 0 type 1\n\nSo here checking if batch buffer already have MI_BATCH_BUFFER_END if\nnot append it.\n\nv2:\n- simply fix, suggestion from Ashutosh\n\n(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/oa: Corregir desbordamiento en el b\u00fafer por lotes de oa. De manera predeterminada, xe_bb_create_job() agrega un MI_BATCH_BUFFER_END al buffer por lotes, esto no es un problema si el buffer por lotes solo se usa una vez, pero oa reutiliza el b\u00fafer por lotes para la misma m\u00e9trica y en cada llamada agrega un MI_BATCH_BUFFER_END, imprimiendo la advertencia a continuaci\u00f3n y luego desbord\u00e1ndose. [ 381.072016] ------------[ cortar aqu\u00ed ]------------ [ 381.072019] xe 0000:00:02.0: [drm] \u00a1La afirmaci\u00f3n `bb-&gt;len * 4 + bb_prefetch(q-&gt;gt) &lt;= size` fall\u00f3! Plataforma: LUNARLAKE Subplataforma: 1 Gr\u00e1ficos: Xe2_LPG / Xe2_HPG 20.04 Paso B0 Medios: Xe2_LPM / Xe2_HPM 20.00 Paso B0 Mosaico: 0 VRAM 0 B GT: 0 Tipo 1 Aqu\u00ed se verifica si el buffer de lote ya tiene MI_BATCH_BUFFER_END si no, se agrega. v2: - simplemente se arregla, sugerencia de Ashutosh (seleccionada del commit 9ba0e0f30ca42a98af3689460063edfb6315718a)"}], "id": "CVE-2024-50090", "lastModified": "2026-08-04T11:21:17.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50090", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-18T15:56:39.428028Z", "version": "2.0.3"}}]}, "published": "2024-11-05T17:15:06.477", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/xe/oa: Fix overflow in oa batch buffer", "id": "2323928", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2323928"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe/oa: Fix overflow in oa batch buffer\nBy default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch\nbuffer, this is not a problem if batch buffer is only used once but\noa reuses the batch buffer for the same metric and at each call\nit appends a MI_BATCH_BUFFER_END, printing the warning below and then\noverflowing.\n[ 381.072016] ------------[ cut here ]------------\n[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!\nplatform: LUNARLAKE subplatform: 1\ngraphics: Xe2_LPG / Xe2_HPG 20.04 step B0\nmedia: Xe2_LPM / Xe2_HPM 20.00 step B0\ntile: 0 VRAM 0 B\nGT: 0 type 1\nSo here checking if batch buffer already have MI_BATCH_BUFFER_END if\nnot append it.\nv2:\n- simply fix, suggestion from Ashutosh\n(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)"], "name": "CVE-2024-50090", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-11-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-50090\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50090\nhttps://lore.kernel.org/linux-cve-announce/2024110551-CVE-2024-50090-2727@gregkh/T"], "threat_severity": "Moderate"}

{}