{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-44978","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-08-21T05:34:56.670Z","datePublished":"2024-09-04T19:54:29.559Z","dateUpdated":"2026-08-05T11:37:25.547Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:37:25.547Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Free job before xe_exec_queue_put\n\nFree job depends on job->vm being valid, the last xe_exec_queue_put can\ndestroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.\n\n(cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f)"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through DRM ioctls on the local Intel Xe render node (/dev/dri/renderD*) — XE_EXEC, XE_EXEC_QUEUE_CREATE/DESTROY — requiring an open file descriptor on the device. There is no remote or adjacent-network path to xe_sched_job_destroy().\nAC:L - The attacker controls every input to the bug: they create the VM and exec queue, submit the jobs, and destroy the queue so the final job reference triggers the put-before-free, and can drive the device into the wedged state to hit the fully synchronous kfree path. Where the free is deferred to a workqueue, the attacker owns both sides of the race and can retry indefinitely with heap grooming.\nPR:L - All ioctls on the path are marked DRM_RENDER_ALLOW with no DRM_AUTH, no DRM master requirement, and no capability check, so an ordinary unprivileged user with render-node access (default on desktop distros via logind ACLs, and common in GPU-enabled containers) can trigger it. No root or CAP_SYS_ADMIN is needed.\nUI:N - The attacker triggers the entire sequence from their own process with no victim action required. No file opening, mount, or interaction by another user is involved.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority as the attacking process. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of struct xe_exec_queue plus a dereference of the already-freed xe_vm through a dangling pointer, and the attacker can reallocate the freed queue to control the pointer that is then read. Per kernel UAF guidance this yields attacker-influenced kernel memory disclosure.\nI:H - The stale q->width read selects which kmem_cache the job is returned to, so a sprayed replacement object produces a wrong-cache kmem_cache_free() and SLUB freelist corruption — a write primitive leveragable for control-flow hijack and privilege escalation. Per guidance, use-after-free is scored High for integrity.\nA:H - Even unexploited, dereferencing the freed exec queue and freed VM causes a kernel oops or panic, and mismatched slab frees corrupt allocator state leading to later crashes. Any unprivileged user with render-node access can repeat this at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_sched_job.c"],"versions":[{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"98aa0330f200b9b8fb9e1298e006eda57a13351c","status":"affected","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"9e7f30563677fbeff62d368d5d2a5ac7aaa9746a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_sched_job.c"],"versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","status":"unaffected","versionType":"semver"},{"version":"6.10.7","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.10.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.11"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/98aa0330f200b9b8fb9e1298e006eda57a13351c"},{"url":"https://git.kernel.org/stable/c/9e7f30563677fbeff62d368d5d2a5ac7aaa9746a"}],"title":"drm/xe: Free job before xe_exec_queue_put","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-44978","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:20:40.351052Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-12T17:33:03.653Z"}}]}}