CVE-2024-26911 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fix alloc_range() error handling code Few users have observed display corruption when they boot the machine to KDE Plasma or playing games. We have root caused the problem that whenever alloc_range() couldn't find the required memory blocks the function was returning SUCCESS in some of the corner cases. The right approach would be if the total allocated size is less than the required size, the function should return -ENOSPC.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2
https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91
https://lore.kernel.org/linux-cve-announce/2024041736-CVE-2024-26911-e758@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26911
https://www.cve.org/CVERecord?id=CVE-2024-26911

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-17T15:59:22.597Z

Updated: 2025-05-04T08:59:25.696Z

Reserved: 2024-02-19T14:20:24.190Z

Link: CVE-2024-26911

Vulnrichment

Updated: 2024-08-02T00:21:05.625Z

NVD

Status : Modified

Published: 2024-04-17T16:15:07.920

Modified: 2024-11-21T09:03:21.793

Link: CVE-2024-26911

Redhat

Severity : Moderate

Publid Date: 2024-04-17T00:00:00Z

Links: CVE-2024-26911 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.190Z", "datePublished": "2024-04-17T15:59:22.597Z", "dateUpdated": "2025-05-04T08:59:25.696Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:59:25.696Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "versions": [{"version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2", "status": "affected", "versionType": "git"}, {"version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}], "title": "drm/buddy: Fix alloc_range() error handling code", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T19:09:43.602719Z", "id": "CVE-2024-26911", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:09:57.405Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.625Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.625Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T19:09:43.602719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:09:51.244Z"}}], "cna": {"title": "drm/buddy: Fix alloc_range() error handling code", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "4b59c3fada06e5e8010ef7700689c71986e667a2", "versionType": "git"}, {"status": "affected", "version": "0a1844bf0b532d84324453374ad6845f64066c28", "lessThan": "8746c6c9dfa31d269c65dd52ab42fde0720b7d91", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/drm_buddy.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:59:25.696Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26911", "state": "PUBLISHED", "dateUpdated": "2025-05-04T08:59:25.696Z", "dateReserved": "2024-02-19T14:20:24.190Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T15:59:22.597Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABAABB52-E12B-4FA5-9F6F-94F0E111832F", "versionEndExcluding": "6.7.6", "versionStartExcluding": "6.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/buddy: corrige el c\u00f3digo de manejo de errores alloc_range() Pocos usuarios han observado da\u00f1os en la pantalla cuando inician la m\u00e1quina en KDE Plasma o juegan juegos. Hemos causado el problema de que cada vez que alloc_range() no pod\u00eda encontrar los bloques de memoria requeridos, la funci\u00f3n devolv\u00eda \u00c9XITO en algunos de los casos de esquina. El enfoque correcto ser\u00eda que si el tama\u00f1o total asignado es menor que el tama\u00f1o requerido, la funci\u00f3n deber\u00eda devolver -ENOSPC."}], "id": "CVE-2024-26911", "lastModified": "2024-11-21T09:03:21.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-17T16:15:07.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "nvd@nist.gov", "type": "Primary"}]}