CVE-2024-44994 (GCVE-0-2024-44994)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-08-05 11:37
VLAI
Title
iommu: Restore lost return in iommu_report_device_fault()
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommu_report_device_fault() When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which results in trying to process the fault and an eventual crash. Deleting the return was a typo, put it back.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
Impacted products
Vendor Product Version
Linux Linux Affected: 3dfa64aecbafc288216b2790438d395add192c30 , < cc6bc2ab1663ec9353636416af22452b078510e9 (git)
Affected: 3dfa64aecbafc288216b2790438d395add192c30 , < fca5b78511e98bdff2cdd55c172b23200a7b3404 (git)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:19:24.535460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:19:36.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc6bc2ab1663ec9353636416af22452b078510e9",
              "status": "affected",
              "version": "3dfa64aecbafc288216b2790438d395add192c30",
              "versionType": "git"
            },
            {
              "lessThan": "fca5b78511e98bdff2cdd55c172b23200a7b3404",
              "status": "affected",
              "version": "3dfa64aecbafc288216b2790438d395add192c30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Restore lost return in iommu_report_device_fault()\n\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\n\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\n\nDeleting the return was a typo, put it back."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control \u2014 an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device\u0027s page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\nPR:L - Only access to an SVA/PASID-capable device node is needed \u2014 idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads \u2014 or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\nUI:N - The fault is generated by the attacker\u0027s own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU\u0027s device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` \u2014 still reachable via `dev-\u003eiommu-\u003efault_param` and `queue-\u003edevices` \u2014 give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops-\u003epage_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\nA:H - The commit itself states the fall-through results in \"an eventual crash\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:33.085Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404"
        }
      ],
      "title": "iommu: Restore lost return in iommu_report_device_fault()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44994",
    "datePublished": "2024-09-04T19:54:40.214Z",
    "dateReserved": "2024-08-21T05:34:56.672Z",
    "dateUpdated": "2026-08-05T11:37:33.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44994",
      "date": "2026-08-10",
      "epss": "0.00192",
      "percentile": "0.09067"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"E94ACAFB-7FD4-4D6C-B1EF-5ACFEF7D85D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu: Restore lost return in iommu_report_device_fault()\\n\\nWhen iommu_report_device_fault gets called with a partial fault it is\\nsupposed to collect the fault into the group and then return.\\n\\nInstead the return was accidently deleted which results in trying to\\nprocess the fault and an eventual crash.\\n\\nDeleting the return was a typo, put it back.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu: Restaurar retorno perdido en iommu_report_device_fault() Cuando se llama a iommu_report_device_fault con un error parcial, se supone que debe recopilar el error en el grupo y luego regresar. En cambio, el retorno se elimin\\u00f3 accidentalmente, lo que da como resultado el intento de procesar el error y un bloqueo final. Eliminar el retorno fue un error tipogr\\u00e1fico, vuelva a colocarlo.\"}]",
      "id": "CVE-2024-44994",
      "lastModified": "2024-10-10T15:59:06.093",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-04T20:15:08.307",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44994\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T20:15:08.307\",\"lastModified\":\"2026-08-04T11:20:08.020\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu: Restore lost return in iommu_report_device_fault()\\n\\nWhen iommu_report_device_fault gets called with a partial fault it is\\nsupposed to collect the fault into the group and then return.\\n\\nInstead the return was accidently deleted which results in trying to\\nprocess the fault and an eventual crash.\\n\\nDeleting the return was a typo, put it back.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu: Restaurar retorno perdido en iommu_report_device_fault() Cuando se llama a iommu_report_device_fault con un error parcial, se supone que debe recopilar el error en el grupo y luego regresar. En cambio, el retorno se elimin\u00f3 accidentalmente, lo que da como resultado el intento de procesar el error y un bloqueo final. Eliminar el retorno fue un error tipogr\u00e1fico, vuelva a colocarlo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/io-pgfault.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3dfa64aecbafc288216b2790438d395add192c30\",\"lessThan\":\"cc6bc2ab1663ec9353636416af22452b078510e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3dfa64aecbafc288216b2790438d395add192c30\",\"lessThan\":\"fca5b78511e98bdff2cdd55c172b23200a7b3404\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/io-pgfault.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.7\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-04T20:19:24.535460Z\",\"id\":\"CVE-2024-44994\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"E94ACAFB-7FD4-4D6C-B1EF-5ACFEF7D85D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:08:28+00:00",
      "cve": "CVE-2024-44994",
      "id": "CVE-2024-44994",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu: Restore lost return in iommu_report_device_fault()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44994.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:40:13Z",
      "cve": "CVE-2024-44994",
      "id": "CVE-2024-44994",
      "initial_release_date": "2024-09-05T02:46:26Z",
      "product_status:known_not_affected": "324",
      "product_status:recommended": "89",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44994",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44994.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44994\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-04T20:19:24.535460Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-04T20:19:26.964Z\"}}], \"cna\": {\"title\": \"iommu: Restore lost return in iommu_report_device_fault()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control \\u2014 an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device\u0027s page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\\nPR:L - Only access to an SVA/PASID-capable device node is needed \\u2014 idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads \\u2014 or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\\nUI:N - The fault is generated by the attacker\u0027s own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU\u0027s device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` \\u2014 still reachable via `dev-\u003eiommu-\u003efault_param` and `queue-\u003edevices` \\u2014 give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops-\u003epage_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\\nA:H - The commit itself states the fall-through results in \\\"an eventual crash\\\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3dfa64aecbafc288216b2790438d395add192c30\", \"lessThan\": \"cc6bc2ab1663ec9353636416af22452b078510e9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3dfa64aecbafc288216b2790438d395add192c30\", \"lessThan\": \"fca5b78511e98bdff2cdd55c172b23200a7b3404\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iommu/io-pgfault.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iommu/io-pgfault.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9\"}, {\"url\": \"https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu: Restore lost return in iommu_report_device_fault()\\n\\nWhen iommu_report_device_fault gets called with a partial fault it is\\nsupposed to collect the fault into the group and then return.\\n\\nInstead the return was accidently deleted which results in trying to\\nprocess the fault and an eventual crash.\\n\\nDeleting the return was a typo, put it back.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:37:33.085Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44994\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:37:33.085Z\", \"dateReserved\": \"2024-08-21T05:34:56.672Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T19:54:40.214Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…