CVE-2024-44978 drm/xe: Free job before xe_exec_queue_put
A use-after-free vulnerability in the Linux kernel's Xe driver allows attackers to potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44978?
CVE-2024-44978 is a high-severity use after free vulnerability in Linux kernel, published on 4 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Free job before xe_exec_queue_put
Free job depends on job->vm being valid, the last xe_exec_queue_put can destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.
(cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f)
Weakness: CWE-416
Which versions are affected by CVE-2024-44978?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-44978?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-44978 being exploited?
There is no known exploitation of CVE-2024-44978 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-44978, DEBIAN-CVE-2024-44978, GHSA-qmgp-8gjw-93v8, UBUNTU-CVE-2024-44978.