In the Linux kernel, the following vulnerability has been resolved:
dma-buf: heaps: Fix off-by-one in CMA heap fault handler
Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault offset against the buffer size, but gets the boundary wrong by 1. Fix the boundary check so that we don't read off the end of the pages array and insert an arbitrary page in the mapping.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Oct 7, 2024 | Sep 27, 2024 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade dtb-armUpgrade kernel-source-vanillaUpgrade kernel-rtUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-develUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade dtb-amlogicUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade reiserfs-kmp-azureUpgrade dtb-exynosUpgrade gfs2-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-azureUpgrade kernel-sourceUpgrade dtb-rockchipUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-defaultUpgrade dtb-sprdUpgrade kernel-syms-rtUpgrade dtb-qcomUpgrade dlm-kmp-64kbUpgrade dtb-caviumUpgrade dtb-renesasUpgrade kernel-default-extraUpgrade dtb-amdUpgrade dtb-allwinnerUpgrade ocfs2-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-develUpgrade kernel-debugUpgrade dtb-mediatekUpgrade kernel-debug-develUpgrade kernel-default-livepatchUpgrade dtb-socionextUpgrade ocfs2-kmp-rtUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade reiserfs-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-64kbUpgrade dtb-lgUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-optionalUpgrade dtb-marvellUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-azure-optionalUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-baseUpgrade dtb-appleUpgrade dtb-apm | Dec 5, 2025 | Nov 13, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1070-gkeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-127-generic-lpaeUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-nvidiaUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-127-genericUpgrade linux-image-oem-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1073-awsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-intelUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-5.15.0-1071-intel-iotgUpgrade linux-image-5.15.0-1066-ibmUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-1070-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1072-gcpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-1056-gkeopUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-virtualUpgrade linux-image-nvidia-6.8Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1020-azureUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-5.15.0-1068-nvidiaUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-127-lowlatency-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-ibmUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-127-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1068-nvidia-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1066-raspiUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-5.15.0-1071-oracleUpgrade linux-image-gkeop-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-127-generic-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-oem-20.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-ibm-classicUpgrade linux-image-kvmUpgrade linux-image-gke-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-raspiUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1039-xilinx-zynqmpUpgrade linux-image-oem-24.04aUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-cvm | Dec 13, 2024 | Sep 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Sep 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub