CVE-2024-49876

EUVD-2024-43727
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: fix UAF around queue destruction

We currently do stuff like queuing the final destruction step on a
random system wq, which will outlive the driver instance. With bad
timing we can teardown the driver with one or more work workqueue still
being alive leading to various UAF splats. Add a fini step to ensure
user queues are properly torn down. At this point GuC should already be
nuked so queue itself should no longer be referenced from hw pov.

v2 (Matt B)
 - Looks much safer to use a waitqueue and then just wait for the
   xa_array to become empty before triggering the drain.

(cherry picked from commit 861108666cc0e999cffeab6aff17b662e68774e3)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 25%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
6.8 ≤
𝑥
< 6.10.14
linuxlinux_kernel
6.11 ≤
𝑥
< 6.11.3
linuxlinux_kernel
6.12:rc1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
6.1.148-1
not-affected
bookworm (security)
6.1.158-1
fixed
bullseye
5.10.223-1
not-affected
bullseye (security)
5.10.247-1
fixed
forky
6.17.13-1
fixed
sid
6.17.13-1
fixed
trixie
6.12.57-1
fixed
trixie (security)
6.12.48-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux-hwe
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
not-affected
linux-hwe-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-5.8
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-5.11
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-57.59~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-hwe-edge
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
ignored
linux-lts-xenial
bionic
dne
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
not-affected
xenial
dne
linux-kvm
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
not-affected
linux-allwinner-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.0
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.8
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.11
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-1023.25~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-aws-hwe
bionic
dne
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
not-affected
linux-azure
bionic
ignored
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1025.30
released
oracular
Fixed 6.11.0-1009.9
released
trusty
not-affected
xenial
not-affected
linux-azure-4.15
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.8
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.11
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-fde
bionic
dne
focal
ignored
jammy
not-affected
noble
not-affected
oracular
dne
trusty
dne
xenial
dne
linux-azure-fde-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-fde-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-fde-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-bluefield
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-edge
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
not-affected
linux-aws-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-azure-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-fips
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp
bionic
ignored
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1024.26
released
oracular
Fixed 6.11.0-1009.9
released
trusty
dne
xenial
not-affected
linux-gcp-4.15
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.8
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.11
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gcp-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-1024.26~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gke
bionic
dne
focal
ignored
jammy
not-affected
noble
Fixed 6.8.0-1019.23
released
oracular
dne
trusty
dne
xenial
ignored
linux-gke-4.15
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gke-5.4
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gke-5.15
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gkeop
bionic
dne
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1006.8
released
oracular
dne
trusty
dne
xenial
dne
linux-gkeop-5.4
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-gkeop-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-ibm
bionic
dne
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1022.22
released
oracular
dne
trusty
dne
xenial
dne
linux-ibm-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-ibm-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-intel-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-intel-iotg
bionic
dne
focal
dne
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-intel-iotg-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-iot
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-intel-iot-realtime
bionic
dne
focal
dne
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-lowlatency
bionic
dne
focal
dne
jammy
not-affected
noble
Fixed 6.8.0-54.56.1
released
oracular
Fixed 6.11.0-1010.11
released
trusty
dne
xenial
dne
linux-lowlatency-hwe-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-lowlatency-hwe-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-lowlatency-hwe-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-lowlatency-hwe-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-lowlatency-hwe-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-54.56.1~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-nvidia
bionic
dne
focal
dne
jammy
not-affected
noble
Fixed 6.8.0-1022.25
released
oracular
dne
trusty
dne
xenial
dne
linux-nvidia-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-nvidia-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-nvidia-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-1022.25~22.04.2
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-nvidia-lowlatency
bionic
dne
focal
dne
jammy
dne
noble
Fixed 6.8.0-1022.25.2
released
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.0
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.3
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.8
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.11
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oracle-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-1020.21~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem
bionic
ignored
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
ignored
linux-oem-5.6
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-5.10
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-5.13
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-5.14
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-5.17
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-6.0
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-6.1
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-6.8
bionic
dne
focal
dne
jammy
dne
noble
Fixed 6.8.0-1024.24
released
oracular
dne
trusty
dne
xenial
dne
linux-raspi2
bionic
ignored
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
ignored
linux-raspi-5.4
bionic
not-affected
focal
dne
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-raspi-realtime
bionic
dne
focal
dne
jammy
dne
noble
Fixed 6.8.0-2018.19
released
oracular
dne
trusty
dne
xenial
dne
linux-realtime
bionic
dne
focal
dne
jammy
not-affected
noble
Fixed 6.8.1-1016.17
released
oracular
Fixed 6.11.0-1005.5
released
trusty
dne
xenial
dne
linux-riscv
bionic
dne
focal
ignored
jammy
ignored
noble
Fixed 6.8.0-53.55.1
released
oracular
Fixed 6.11.0-17.17.1
released
trusty
dne
xenial
dne
linux-riscv-5.8
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-riscv-5.11
bionic
dne
focal
ignored
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-riscv-5.15
bionic
dne
focal
not-affected
jammy
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-riscv-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-riscv-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-riscv-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-53.55.1~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-starfive-5.19
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-starfive-6.2
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-starfive-6.5
bionic
dne
focal
dne
jammy
ignored
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-xilinx-zynqmp
bionic
dne
focal
not-affected
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-54.56
released
oracular
Fixed 6.11.0-18.18
released
trusty
not-affected
xenial
not-affected
linux-aws
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1023.25
released
oracular
Fixed 6.11.0-1009.10
released
trusty
not-affected
xenial
not-affected
linux-oracle
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1020.21
released
oracular
Fixed 6.11.0-1011.12
released
trusty
dne
xenial
not-affected
linux-raspi
bionic
dne
focal
not-affected
jammy
not-affected
noble
Fixed 6.8.0-1019.23
released
oracular
Fixed 6.11.0-1008.8
released
trusty
dne
xenial
dne
linux-intel
bionic
dne
focal
dne
jammy
dne
noble
not-affected
oracular
dne
trusty
dne
xenial
dne
linux-azure-6.8
bionic
dne
focal
dne
jammy
Fixed 6.8.0-1025.30~22.04.1
released
noble
dne
oracular
dne
trusty
dne
xenial
dne
linux-oem-6.11
bionic
dne
focal
dne
jammy
dne
noble
Fixed 6.11.0-1015.15
released
oracular
dne
trusty
dne
xenial
dne
linux-hwe-6.11
bionic
dne
focal
dne
jammy
dne
noble
not-affected
oracular
dne
trusty
dne
xenial
dne
linux-lowlatency-hwe-6.11
bionic
dne
focal
dne
jammy
dne
noble
not-affected
oracular
dne
trusty
dne
xenial
dne
linux-nvidia-tegra
bionic
dne
focal
dne
jammy
not-affected
noble
not-affected
oracular
dne
trusty
dne
xenial
dne
linux-nvidia-tegra-igx
bionic
dne
focal
dne
jammy
not-affected
noble
dne
oracular
dne
trusty
dne
xenial
dne