In the Linux kernel, the following vulnerability has been resolved:
drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper.
This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Oct 9, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-debugUpgrade kernel-azure-extraUpgrade dtb-lgUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-amlogicUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-default-develUpgrade dtb-appleUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-extraUpgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade dlm-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-default-extraUpgrade dtb-renesasUpgrade kernel-default-livepatchUpgrade dtb-broadcomUpgrade kernel-rt_debug-develUpgrade kernel-debug-develUpgrade kernel-docs-htmlUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debugUpgrade kernel-source-azureUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade dtb-socionextUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade kernel-docsUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-rtUpgrade dtb-marvellUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade kernel-syms-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-preempt-develUpgrade dtb-sprdUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade dtb-exynosUpgrade kernel-devel-rtUpgrade kernel-azure-develUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-rtUpgrade kernel-rt-develUpgrade ocfs2-kmp-azureUpgrade kernel-rtUpgrade dtb-caviumUpgrade dtb-nvidiaUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-kvmsmallUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-alteraUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade dtb-qcomUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-preemptUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-optional | Aug 9, 2024 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub