In the Linux kernel, the following vulnerability has been resolved:
drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper.
This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade bpftoolUpgrade kernel-tools | Oct 9, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-rt_debugUpgrade kernel-debugUpgrade kernel-default-develUpgrade dtb-lgUpgrade kernel-azure-extraUpgrade reiserfs-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-docs-htmlUpgrade dtb-amazonUpgrade kernel-64kb-livepatch-develUpgrade kernel-azureUpgrade dtb-broadcomUpgrade kernel-64kb-extraUpgrade kernel-debug-develUpgrade kernel-docsUpgrade dtb-appleUpgrade kernel-source-azureUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-default-livepatchUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-rt-optionalUpgrade dtb-marvellUpgrade kselftests-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kernel-macrosUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-apmUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-syms-rtUpgrade kernel-rt-extraUpgrade ocfs2-kmp-64kbUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-freescaleUpgrade dtb-socionextUpgrade kernel-rt_debug-vdsoUpgrade kernel-zfcpdumpUpgrade dlm-kmp-rtUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-qcomUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-preemptUpgrade dtb-armUpgrade kernel-preempt-develUpgrade cluster-md-kmp-rtUpgrade kernel-azure-develUpgrade kernel-sourceUpgrade dtb-rockchipUpgrade kselftests-kmp-64kbUpgrade dtb-exynosUpgrade kernel-devel-rtUpgrade dtb-sprdUpgrade kernel-default-optionalUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-nvidiaUpgrade dtb-caviumUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade kernel-kvmsmallUpgrade gfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-devel-azureUpgrade dtb-altera | Aug 9, 2024 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub