{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-38581",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-38581"
  ],
  "published": "2024-06-19T13:37:58Z",
  "summary": "drm/amdgpu/mes: fix use-after-free issue",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/mes: fix use-after-free issue\n\nDelete fence fallback timer to fix the ramdom\nuse-after-free issue.\n\nv2: move to amdgpu_mes.c",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.93",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38581"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/70b1bf6d9edc8692d241f59a65f073aec6d501de"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/39cfce75168c11421d70b8c0c65f6133edccb82a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0f98c144c15c8fc0f3176c994bd4e727ef718a5c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/948255282074d9367e01908b3f5dcf8c10fc9c3d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable path lives in the amdgpu GPU driver and is reached through local device access \u2014 opening/ioctl'ing /dev/dri/renderD* triggers pm_runtime_get_sync(), and the resulting runtime-PM resume runs amdgpu_mes_self_test(). There is no network-facing component.\nAC:L - The attacker drives both sides of the timer-versus-free race: they trigger the MES self-test arbitrarily often via runtime PM cycles, and they control GPU load so the IB test times out \u2014 the path on which the fallback timer is left deterministically armed across kfree(ring). Repeated attempts are free and unlimited.\nPR:L - A basic unprivileged local user with access to the DRM render node (default on desktop/laptop distros via the render group or logind ACLs) can open the device and force runtime suspend/resume cycles; no capabilities or root are needed.\nUI:N - The attacker self-triggers the runtime-PM resume that runs the self-test through its own open()/ioctl() calls; no victim action such as a manual suspend or file open is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed struct amdgpu_ring comes from a generic kmalloc cache reclaimable by attacker-sprayed data, and the timer callback dereferences ring->adev, ring->fence_drv.fences[] and fence->ops from it, allowing attacker-directed reads of arbitrary kernel memory.\nI:H - The callback performs atomic_cmpxchg() and RCU_INIT_POINTER() writes into the freed object and makes indirect calls through fence->ops read out of reclaimed memory, yielding write and control-flow-hijack primitives; freeing an armed timer_list also corrupts the timer base list.\nA:H - Even unweaponized, the fallback timer firing on freed memory produces a use-after-free oops/panic or timer-list corruption, and it can be re-triggered on every resume cycle."
    }
  }
}