CVE-2024-49865

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xaalloc to prevent UAF Evil user can guess the next id of the vm before the ioctl completes and then call vm destroy ioctl to trigger UAF since create ioctl is still referencing the same vm. Move the xaalloc all t...

UBUNTU-CVE-2024-49942

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xemigratecopy xemigratecopy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xemigratecopy. To avoid this situation,...

UBUNTU-CVE-2024-49865

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xaalloc to prevent UAF Evil user can guess the next id of the vm before the ioctl completes and then call vm destroy ioctl to trigger UAF since create ioctl is still referencing the same vm. Move the xaalloc all t...

UBUNTU-CVE-2024-49876

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more wor...

CVE-2024-49990 drm/xe/hdcp: Check GSC structure validity

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Check GSC structure validity Sometimes xegsc is not initialized when checked at HDCP capability check. Add gsc structure check to avoid null pointer error...

CVE-2024-49942 drm/xe: Prevent null pointer access in xe_migrate_copy

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xemigratecopy xemigratecopy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xemigratecopy. To avoid this situation,...

CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: add missing locking in wedgedfini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after...

CVE-2024-49942 drm/xe: Prevent null pointer access in xe_migrate_copy

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xemigratecopy xemigratecopy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xemigratecopy. To avoid this situation,...

CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: add missing locking in wedgedfini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after...

CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: add missing locking in wedgedfini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after...

CVE-2024-49876

CVE-2024-49876 affects the Linux kernel DRM-Xe path. The issue is a use-after-free (UAF) around queue destruction where final destruction steps could run on a workqueue that outlives the driver instance, risking references to freed objects. The fix adds a fini step to ensure user queues are torn ...

CVE-2024-49876 drm/xe: fix UAF around queue destruction

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more wor...

CVE-2024-49876 drm/xe: fix UAF around queue destruction

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more wor...

CVE-2024-49865

CVE-2024-49865 affects the Linux kernel’s DRM XE VM code. The root cause is a use-after-free risk caused by the timing of allocating VM IDs with xa_alloc, which allowed an Evil user to guess the next VM id before vm destroy/ioctl completes, potentially exposing references to the same VM that is s...

SUSE CVE-2024-47729

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...

CVE-2024-47729

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...

DEBIAN-CVE-2024-47729

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...

UBUNTU-CVE-2024-47729

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...

CVE-2024-47729

CVE-2024-47729 affects the Linux kernel DRM-XE path. Affected component: user binds mapping to engines that can fault; the completion order can cause a deadlock between user binds and faulting devices. Root cause: binding to engines on faulting devices can deadlock due to how fault handling inter...

CVE-2024-47729

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...