CVE-2024-43863

MEDIUM EPSS 6.0%
Published Aug 21, 20241y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Aug 21, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks. vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock. dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called. Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
6.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-667

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥3.18  –  <5.15.165
linuxlinux_kernel*≥5.16  –  <6.1.104
linuxlinux_kernel*≥6.2  –  <6.6.45
linuxlinux_kernel*≥6.7  –  <6.10.4
linuxlinux_kernel6.11any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/3b933b16c996af8adb6bc1b5748a63dfb41a82bc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9908dc0d2ef0e4aec8a242c098455729c0e2f017
  • git.kernel.org https://git.kernel.org/stable/c/9e20d028d8d1deb1e7fed18f22ffc01669cf3237
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a8943969f9ead2fd3044fc826140a21622ef830e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c98ab18b9f315ff977c2c65d7c71298ef98be8e3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e58337100721f3cc0c7424a18730e4f39844934f
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/3b933b16c996af8adb6bc1b5748a63dfb41a82bc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9e20d028d8d1deb1e7fed18f22ffc01669cf3237
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a8943969f9ead2fd3044fc826140a21622ef830e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c98ab18b9f315ff977c2c65d7c71298ef98be8e3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e58337100721f3cc0c7424a18730e4f39844934f
    Patch