In the Linux kernel, the following vulnerability has been resolved:
drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper.
This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libs | Oct 9, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-sourceUpgrade cluster-md-kmp-rtUpgrade dtb-rockchipUpgrade kernel-preemptUpgrade kernel-default-optionalUpgrade kernel-azure-develUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-alteraUpgrade kernel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-defaultUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade kernel-rt-develUpgrade dtb-sprdUpgrade kernel-preempt-develUpgrade dtb-mediatekUpgrade kernel-azure-optionalUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-devel-rtUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-armUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade dtb-xilinxUpgrade kernel-syms-rtUpgrade dtb-appleUpgrade dtb-socionextUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-docsUpgrade kernel-debug-develUpgrade dtb-amazonUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-default-extraUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade dlm-kmp-rtUpgrade dtb-amdUpgrade kernel-64kbUpgrade kernel-debug-vdsoUpgrade dtb-lgUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amlogicUpgrade kernel-debugUpgrade kselftests-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatchUpgrade dtb-renesasUpgrade kernel-defaultUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade dtb-marvellUpgrade kernel-source-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade kernel-rt-optionalUpgrade kernel-azure-extraUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-azureUpgrade dtb-broadcom | Aug 9, 2024 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub