GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-41060 (GCVE-0-2024-41060)

Vulnerability from cvelistv5 – Published: 2024-07-29 14:57 – Updated: 2026-08-05 11:35
VLAI
Title
drm/radeon: check bo_va->bo is non-NULL before using it
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:22 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2f2624c23511b4bf0dd3d4c5ae167715513f351d , < e8d3c53c6f1cccea9c03113f06dd39521c228831 (git)
Affected: 2f2624c23511b4bf0dd3d4c5ae167715513f351d , < a2b201f83971df03c8e81a480b2f2846ae8ce1a3 (git)
Affected: 2f2624c23511b4bf0dd3d4c5ae167715513f351d , < a9100f17428cb733c4f6fbb132d98bed76318342 (git)
Affected: 2f2624c23511b4bf0dd3d4c5ae167715513f351d , < f13c96e0e325a057c03f8a47734adb360e112efe (git)
Affected: 2f2624c23511b4bf0dd3d4c5ae167715513f351d , < 8a500b3a5f0a58c6f99039091fbd715f64f2f8af (git)
Affected: 2f2624c23511b4bf0dd3d4c5ae167715513f351d , < 6fb15dcbcf4f212930350eaee174bb60ed40a536 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 5.15.164 , ≤ 5.15.* (semver)
Unaffected: 6.1.101 , ≤ 6.1.* (semver)
Unaffected: 6.6.42 , ≤ 6.6.* (semver)
Unaffected: 6.9.11 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:08.758Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:22:11.951326Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:01.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/radeon/radeon_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8d3c53c6f1cccea9c03113f06dd39521c228831",
              "status": "affected",
              "version": "2f2624c23511b4bf0dd3d4c5ae167715513f351d",
              "versionType": "git"
            },
            {
              "lessThan": "a2b201f83971df03c8e81a480b2f2846ae8ce1a3",
              "status": "affected",
              "version": "2f2624c23511b4bf0dd3d4c5ae167715513f351d",
              "versionType": "git"
            },
            {
              "lessThan": "a9100f17428cb733c4f6fbb132d98bed76318342",
              "status": "affected",
              "version": "2f2624c23511b4bf0dd3d4c5ae167715513f351d",
              "versionType": "git"
            },
            {
              "lessThan": "f13c96e0e325a057c03f8a47734adb360e112efe",
              "status": "affected",
              "version": "2f2624c23511b4bf0dd3d4c5ae167715513f351d",
              "versionType": "git"
            },
            {
              "lessThan": "8a500b3a5f0a58c6f99039091fbd715f64f2f8af",
              "status": "affected",
              "version": "2f2624c23511b4bf0dd3d4c5ae167715513f351d",
              "versionType": "git"
            },
            {
              "lessThan": "6fb15dcbcf4f212930350eaee174bb60ed40a536",
              "status": "affected",
              "version": "2f2624c23511b4bf0dd3d4c5ae167715513f351d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/radeon/radeon_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.101",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.42",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.11",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: check bo_va-\u003ebo is non-NULL before using it\n\nThe call to radeon_vm_clear_freed might clear bo_va-\u003ebo, so\nwe have to check it before dereferencing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the RADEON_GEM_VA ioctl on a local DRM device node (/dev/dri/renderD128 or card0), raced against DRM_IOCTL_GEM_CLOSE on the same fd. No network or physical access is involved.\nAC:L - The attacker owns both sides of the race \u2014 one thread issues GEM_VA MAP, another issues GEM_CLOSE \u2014 and radeon_vm_bo_set_addr() unreserves the BO and then performs long page-table allocation and GPU IB submission before radeon_gem_va_update_vm() runs, leaving a very wide, reliably winnable window.\nPR:L - RADEON_GEM_VA and GEM_CLOSE are both DRM_RENDER_ALLOW and drm_ioctl bypasses DRM_AUTH for render clients, so any local unprivileged user (or containerized/sandboxed process handed a render node) can reach the path with no capabilities.\nUI:N - The attacker drives the entire sequence from its own two threads on a self-opened DRM fd; no victim action or cooperation is needed.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 a standard local kernel memory-safety bug, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - This is a use-after-free of the radeon_bo_va slab object; with the freed slot refilled, bo_va-\u003ebo-\u003etbo.resource supplies mem-\u003estart, which is programmed as a raw physical address into GPU page tables, giving GPU-side reads of arbitrary physical memory.\nI:H - The freed object is written through by radeon_vm_bo_update() via list_del()/list_add() on bo_va-\u003evm_status and bo_va-\u003eflags, and bo_va-\u003evm is dereferenced for mutex_unlock(), yielding unlink/write primitives plus attacker-influenced GPU page-table entries.\nA:H - In the common case the freed bo_va still holds the NULL written by radeon_bo_unref(), so bo_va-\u003ebo-\u003etbo.resource is a NULL-pointer dereference producing an immediate kernel oops, and any unlucky slab reuse panics on corrupted list pointers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:05.718Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e8d3c53c6f1cccea9c03113f06dd39521c228831"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342"
        },
        {
          "url": "https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536"
        }
      ],
      "title": "drm/radeon: check bo_va-\u003ebo is non-NULL before using it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41060",
    "datePublished": "2024-07-29T14:57:22.499Z",
    "dateReserved": "2024-07-12T12:17:45.627Z",
    "dateUpdated": "2026-08-05T11:35:05.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41060",
      "date": "2026-09-16",
      "epss": "0.00248",
      "percentile": "0.16326"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.15.164\", \"matchCriteriaId\": \"1FF9AD93-F189-4A07-8D09-3DD62D5077A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.101\", \"matchCriteriaId\": \"2B46438B-72B8-4053-8554-94AED3EB13EB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.42\", \"matchCriteriaId\": \"972274A2-D688-4C37-BE42-689B58B4C225\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.11\", \"matchCriteriaId\": \"01E300B3-8B39-4A2D-8B03-4631433D3915\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"BD973AA4-A789-49BD-8D57-B2846935D3C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/radeon: check bo_va-\u003ebo is non-NULL before using it\\n\\nThe call to radeon_vm_clear_freed might clear bo_va-\u003ebo, so\\nwe have to check it before dereferencing it.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/radeon: verifique que bo_va-\u0026gt;bo no sea NULL antes de usarlo. La llamada a radeon_vm_clear_freed podr\\u00eda borrar bo_va-\u0026gt;bo, por lo que debemos verificarlo antes de eliminar la referencia.\"}]",
      "id": "CVE-2024-41060",
      "lastModified": "2024-11-21T09:32:09.817",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-29T15:15:14.030",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41060\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:14.030\",\"lastModified\":\"2026-08-04T11:19:24.600\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/radeon: check bo_va-\u003ebo is non-NULL before using it\\n\\nThe call to radeon_vm_clear_freed might clear bo_va-\u003ebo, so\\nwe have to check it before dereferencing it.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/radeon: verifique que bo_va-\u0026gt;bo no sea NULL antes de usarlo. La llamada a radeon_vm_clear_freed podr\u00eda borrar bo_va-\u0026gt;bo, por lo que debemos verificarlo antes de eliminar la referencia.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/radeon/radeon_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f2624c23511b4bf0dd3d4c5ae167715513f351d\",\"lessThan\":\"e8d3c53c6f1cccea9c03113f06dd39521c228831\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2624c23511b4bf0dd3d4c5ae167715513f351d\",\"lessThan\":\"a2b201f83971df03c8e81a480b2f2846ae8ce1a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2624c23511b4bf0dd3d4c5ae167715513f351d\",\"lessThan\":\"a9100f17428cb733c4f6fbb132d98bed76318342\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2624c23511b4bf0dd3d4c5ae167715513f351d\",\"lessThan\":\"f13c96e0e325a057c03f8a47734adb360e112efe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2624c23511b4bf0dd3d4c5ae167715513f351d\",\"lessThan\":\"8a500b3a5f0a58c6f99039091fbd715f64f2f8af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2624c23511b4bf0dd3d4c5ae167715513f351d\",\"lessThan\":\"6fb15dcbcf4f212930350eaee174bb60ed40a536\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/radeon/radeon_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.164\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.101\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.42\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.11\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:22:11.951326Z\",\"id\":\"CVE-2024-41060\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.164\",\"matchCriteriaId\":\"1FF9AD93-F189-4A07-8D09-3DD62D5077A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.101\",\"matchCriteriaId\":\"2B46438B-72B8-4053-8554-94AED3EB13EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.42\",\"matchCriteriaId\":\"972274A2-D688-4C37-BE42-689B58B4C225\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.11\",\"matchCriteriaId\":\"01E300B3-8B39-4A2D-8B03-4631433D3915\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD973AA4-A789-49BD-8D57-B2846935D3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8d3c53c6f1cccea9c03113f06dd39521c228831\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:40+00:00",
      "cve": "CVE-2024-41060",
      "id": "CVE-2024-41060",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/radeon: check bo_va-\u0026gt;bo is non-NULL before using it",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41060.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:30:29Z",
      "cve": "CVE-2024-41060",
      "id": "CVE-2024-41060",
      "initial_release_date": "2024-08-06T02:01:34Z",
      "product_status:known_affected": "516",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "747",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-41060",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41060.json",
      "version": "111"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:00:08.758Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41060\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:22:11.951326Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.221Z\"}}], \"cna\": {\"title\": \"drm/radeon: check bo_va-\u003ebo is non-NULL before using it\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2f2624c23511b4bf0dd3d4c5ae167715513f351d\", \"lessThan\": \"e8d3c53c6f1cccea9c03113f06dd39521c228831\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2624c23511b4bf0dd3d4c5ae167715513f351d\", \"lessThan\": \"a2b201f83971df03c8e81a480b2f2846ae8ce1a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2624c23511b4bf0dd3d4c5ae167715513f351d\", \"lessThan\": \"a9100f17428cb733c4f6fbb132d98bed76318342\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2624c23511b4bf0dd3d4c5ae167715513f351d\", \"lessThan\": \"f13c96e0e325a057c03f8a47734adb360e112efe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2624c23511b4bf0dd3d4c5ae167715513f351d\", \"lessThan\": \"8a500b3a5f0a58c6f99039091fbd715f64f2f8af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2624c23511b4bf0dd3d4c5ae167715513f351d\", \"lessThan\": \"6fb15dcbcf4f212930350eaee174bb60ed40a536\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/radeon/radeon_gem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.234\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.164\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/radeon/radeon_gem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e8d3c53c6f1cccea9c03113f06dd39521c228831\"}, {\"url\": \"https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3\"}, {\"url\": \"https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342\"}, {\"url\": \"https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe\"}, {\"url\": \"https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af\"}, {\"url\": \"https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/radeon: check bo_va-\u003ebo is non-NULL before using it\\n\\nThe call to radeon_vm_clear_freed might clear bo_va-\u003ebo, so\\nwe have to check it before dereferencing it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.234\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.164\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.101\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.42\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.11\", \"versionStartIncluding\": \"3.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:37:26.908Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41060\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:37:26.908Z\", \"dateReserved\": \"2024-07-12T12:17:45.627Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:57:22.499Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.