CVE-2024-26922 (GCVE-0-2024-26922)

Vulnerability from cvelistv5 – Published: 2024-04-23 13:05 – Updated: 2026-08-05 11:28
VLAI
Title
drm/amdgpu: validate the parameters of bo mapping operations more clearly
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < d4da6b084f1c5625937d49bb6722c5b4aef11b8d (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < f68039375d4d6d67303674c0ab2d06b7295c0ec9 (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < 1fd7db5c16028dc07b2ceec190f2e895dddb532d (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < 8b12fc7b032633539acdf7864888b0ebd49e90f2 (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < 212e3baccdb1939606420d88f7f52d346b49a284 (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < ef13eeca7c79136bc38e21eb67322c1cbd5c40ee (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < b1f04b9b1c5317f562a455384c5f7473e46bdbaa (git)
Affected: dc54d3d1744d23ed0b345fd8bc1c493b74e8df44 , < 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75 (git)
Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 4.19.313 , ≤ 4.19.* (semver)
Unaffected: 5.4.275 , ≤ 5.4.* (semver)
Unaffected: 5.10.216 , ≤ 5.10.* (semver)
Unaffected: 5.15.157 , ≤ 5.15.* (semver)
Unaffected: 6.1.88 , ≤ 6.1.* (semver)
Unaffected: 6.6.29 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:14:43.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26922",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:46:55.644106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:15.988Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d4da6b084f1c5625937d49bb6722c5b4aef11b8d",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "f68039375d4d6d67303674c0ab2d06b7295c0ec9",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "1fd7db5c16028dc07b2ceec190f2e895dddb532d",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "8b12fc7b032633539acdf7864888b0ebd49e90f2",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "212e3baccdb1939606420d88f7f52d346b49a284",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "ef13eeca7c79136bc38e21eb67322c1cbd5c40ee",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "b1f04b9b1c5317f562a455384c5f7473e46bdbaa",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            },
            {
              "lessThan": "6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75",
              "status": "affected",
              "version": "dc54d3d1744d23ed0b345fd8bc1c493b74e8df44",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.313",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.313",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\n\nVerify the parameters of\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered by the DRM_IOCTL_AMDGPU_GEM_VA ioctl on /dev/dri/renderD128 or /dev/dri/card*, which requires local access to the device node. There is no remote or adjacent-network path to amdgpu_vm_bo_clear_mappings().\nAC:L - A single ioctl with an attacker-chosen va_address/map_size pair deterministically overflows the u64 bounds check and produces a reversed range; no race, no memory-layout dependency, no timing window. The attacker fully controls both operands of the overflowing arithmetic.\nPR:L - The ioctl is DRM_AUTH|DRM_RENDER_ALLOW, so any process able to open the render node can reach it \u2014 that includes ordinary desktop users (ACL/render group), GPU-enabled containers, and sandboxed renderer processes on Android/ChromeOS. No CAP_SYS_ADMIN, no DRM_MASTER, no root required.\nUI:N - The attacker performs the entire sequence (create BO, map it, issue the crafted CLEAR) within their own process and its own amdgpu VM. No victim action or cooperation is needed.\nS:U - The corruption is confined to the kernel\u0027s own amdgpu VM structures and GPU page tables managed by the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The malformed split leaves overlapping GPU VA mappings with inconsistent BO offsets in vm-\u003eva, desynchronizing the driver\u0027s mapping state from the programmed PTEs, and the unvalidated range removes the max_pfn guard that keeps page-table walks in bounds. Per kernel scoring guidance, memory/page-table corruption that can be leveraged to expose memory outside the buffer object is High.\nI:H - Overlapping mappings are inserted into the VM interval tree, a mapping with start \u003e last is queued for PTE clearing, and PRT refcounts are skewed \u2014 all of which cause GPU page tables to be programmed inconsistently with the driver\u0027s view. This memory-corruption class is scored High for integrity.\nA:H - The reversed range makes amdgpu_vm_update_range() compute (last - start + 1) * AMDGPU_GPU_PAGE_SIZE as a ~2^64 underflow, driving amdgpu_vm_ptes_update()/amdgpu_vm_pt_alloc() over an ~2^60-page range while holding the VM eviction and reservation locks. The result is unbounded page-table allocation, memory exhaustion, and a soft-lockup/hang of the GPU and system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:20.224Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75"
        }
      ],
      "title": "drm/amdgpu: validate the parameters of bo mapping operations more clearly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26922",
    "datePublished": "2024-04-23T13:05:04.243Z",
    "dateReserved": "2024-02-19T14:20:24.194Z",
    "dateUpdated": "2026-08-05T11:28:20.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26922",
      "date": "2026-08-09",
      "epss": "0.00312",
      "percentile": "0.23583"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\\n\\nVerify the parameters of\\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: valide los par\\u00e1metros de las operaciones de mapeo de bo con mayor claridad. Verifique los par\\u00e1metros de amdgpu_vm_bo_(map/replace_map/clearing_mappings) en un lugar com\\u00fan.\"}]",
      "id": "CVE-2024-26922",
      "lastModified": "2024-11-21T09:03:23.400",
      "published": "2024-04-23T13:15:46.643",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26922\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-23T13:15:46.643\",\"lastModified\":\"2026-08-04T11:17:21.390\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\\n\\nVerify the parameters of\\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: valide los par\u00e1metros de las operaciones de mapeo de bo con mayor claridad. Verifique los par\u00e1metros de amdgpu_vm_bo_(map/replace_map/clearing_mappings) en un lugar com\u00fan.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"d4da6b084f1c5625937d49bb6722c5b4aef11b8d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"f68039375d4d6d67303674c0ab2d06b7295c0ec9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"1fd7db5c16028dc07b2ceec190f2e895dddb532d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"8b12fc7b032633539acdf7864888b0ebd49e90f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"212e3baccdb1939606420d88f7f52d346b49a284\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"b1f04b9b1c5317f562a455384c5f7473e46bdbaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\",\"lessThan\":\"6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.313\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.275\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.216\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.157\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.88\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.29\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.8\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:46:55.644106Z\",\"id\":\"CVE-2024-26922\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.12\",\"versionEndExcluding\":\"4.19.313\",\"matchCriteriaId\":\"BCB83BC6-EF8F-49CA-B75A-F0F9F5446F13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.275\",\"matchCriteriaId\":\"5FF6D8DE-C559-4586-86C8-2C6B4420A2C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.216\",\"matchCriteriaId\":\"A44ABF89-F1BD-4C9A-895D-7596650DCD27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.157\",\"matchCriteriaId\":\"C67E2ABA-9F30-4CE6-A840-B1051D07E0CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.88\",\"matchCriteriaId\":\"B665F958-644E-434D-A78D-CCD1628D1774\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.29\",\"matchCriteriaId\":\"0999E154-1E68-41FA-8DE3-9A735E382224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"673B3328-389D-41A4-9617-669298635262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA277A6C-83EC-4536-9125-97B84C4FAF59\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:49:16+00:00",
      "cve": "CVE-2024-26922",
      "id": "CVE-2024-26922",
      "initial_release_date": "2024-04-23T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: validate the parameters of bo mapping operations more clearly",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26922.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:54:48Z",
      "cve": "CVE-2024-26922",
      "id": "CVE-2024-26922",
      "initial_release_date": "2024-04-24T02:48:41Z",
      "product_status:known_affected": "511",
      "product_status:known_not_affected": "10",
      "product_status:recommended": "745",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26922",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26922.json",
      "version": "98"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:14:43.597Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26922\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:46:55.644106Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.804Z\"}}], \"cna\": {\"title\": \"drm/amdgpu: validate the parameters of bo mapping operations more clearly\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggered by the DRM_IOCTL_AMDGPU_GEM_VA ioctl on /dev/dri/renderD128 or /dev/dri/card*, which requires local access to the device node. There is no remote or adjacent-network path to amdgpu_vm_bo_clear_mappings().\\nAC:L - A single ioctl with an attacker-chosen va_address/map_size pair deterministically overflows the u64 bounds check and produces a reversed range; no race, no memory-layout dependency, no timing window. The attacker fully controls both operands of the overflowing arithmetic.\\nPR:L - The ioctl is DRM_AUTH|DRM_RENDER_ALLOW, so any process able to open the render node can reach it \\u2014 that includes ordinary desktop users (ACL/render group), GPU-enabled containers, and sandboxed renderer processes on Android/ChromeOS. No CAP_SYS_ADMIN, no DRM_MASTER, no root required.\\nUI:N - The attacker performs the entire sequence (create BO, map it, issue the crafted CLEAR) within their own process and its own amdgpu VM. No victim action or cooperation is needed.\\nS:U - The corruption is confined to the kernel\u0027s own amdgpu VM structures and GPU page tables managed by the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the flaw itself.\\nC:H - The malformed split leaves overlapping GPU VA mappings with inconsistent BO offsets in vm-\u003eva, desynchronizing the driver\u0027s mapping state from the programmed PTEs, and the unvalidated range removes the max_pfn guard that keeps page-table walks in bounds. Per kernel scoring guidance, memory/page-table corruption that can be leveraged to expose memory outside the buffer object is High.\\nI:H - Overlapping mappings are inserted into the VM interval tree, a mapping with start \u003e last is queued for PTE clearing, and PRT refcounts are skewed \\u2014 all of which cause GPU page tables to be programmed inconsistently with the driver\u0027s view. This memory-corruption class is scored High for integrity.\\nA:H - The reversed range makes amdgpu_vm_update_range() compute (last - start + 1) * AMDGPU_GPU_PAGE_SIZE as a ~2^64 underflow, driving amdgpu_vm_ptes_update()/amdgpu_vm_pt_alloc() over an ~2^60-page range while holding the VM eviction and reservation locks. The result is unbounded page-table allocation, memory exhaustion, and a soft-lockup/hang of the GPU and system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"d4da6b084f1c5625937d49bb6722c5b4aef11b8d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"f68039375d4d6d67303674c0ab2d06b7295c0ec9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"1fd7db5c16028dc07b2ceec190f2e895dddb532d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"8b12fc7b032633539acdf7864888b0ebd49e90f2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"212e3baccdb1939606420d88f7f52d346b49a284\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"b1f04b9b1c5317f562a455384c5f7473e46bdbaa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44\", \"lessThan\": \"6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.313\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.275\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.88\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d\"}, {\"url\": \"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9\"}, {\"url\": \"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d\"}, {\"url\": \"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2\"}, {\"url\": \"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284\"}, {\"url\": \"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee\"}, {\"url\": \"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa\"}, {\"url\": \"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\\n\\nVerify the parameters of\\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.313\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.275\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.216\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.157\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.88\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:20.224Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26922\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:20.224Z\", \"dateReserved\": \"2024-02-19T14:20:24.194Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-23T13:05:04.243Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.