CVE-2024-40926 drm/nouveau: don't attempt to schedule hpd_work on headless cards
A null pointer dereference in the nouveau driver causes a kernel crash when resuming headless GPUs, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40926?
CVE-2024-40926 is a medium-severity vulnerability in Linux kernel, published on 12 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: don't attempt to schedule hpd_work on headless cards
If the card doesn't have display hardware, hpd_work and hpd_lock are left uninitialized which causes BUG when attempting to schedule hpd_work on runtime PM resume.
Fix it by adding headless flag to DRM and skip any hpd if it's set.
Weakness: CWE-908
Which versions are affected by CVE-2024-40926?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-40926?
Apply the vendor's patch.
Is CVE-2024-40926 being exploited?
There is no known exploitation of CVE-2024-40926 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-40926, DEBIAN-CVE-2024-40926, GHSA-88vm-fw2c-f253, UBUNTU-CVE-2024-40926.