{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58086","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-03-06T15:52:09.184Z","datePublished":"2025-03-06T16:28:23.042Z","dateUpdated":"2026-09-08T08:40:07.491Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:47:37.348Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Stop active perfmon if it is being destroyed\n\nIf the active performance monitor (`v3d->active_perfmon`) is being\ndestroyed, stop it first. Currently, the active perfmon is not\nstopped during destruction, leaving the `v3d->active_perfmon` pointer\nstale. This can lead to undefined behavior and instability.\n\nThis patch ensures that the active perfmon is stopped before being\ndestroyed, aligning with the behavior introduced in commit\n7d1fd3638ee3 (\"drm/v3d: Stop the active perfmon before being destroyed\")."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through DRM ioctls (`V3D_PERFMON_CREATE/DESTROY`, `V3D_SUBMIT_CL/CSD`) on the local `/dev/dri/renderD*` device node. No network or physical component is involved.\nAC:L - No race is required — the attacker performs a deterministic, fully self-controlled sequence (create perfmon, submit a job with it, wait for the fence, destroy it, submit another job) and additionally controls the freed object's slab size via `ncounters` and the reclaim window before the stale pointer is used.\nPR:L - The perfmon ioctls are `DRM_RENDER_ALLOW` with no `DRM_AUTH` or capability check, so any local unprivileged user with render-node access (standard for GUI/GPU users on Raspberry Pi OS, Android apps, embedded/kiosk V3D systems) can trigger it. No root or DRM master privilege is needed.\nUI:N - A single unprivileged process performs every step itself via ioctls on its own file descriptor. No victim action or interaction is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `v3d->active_perfmon` is dereferenced after `kfree()`, reading `perfmon->ncounters` and `perfmon->values[]` from a slab slot the attacker can reclaim with a chosen object; `v3d_write_performance_query_result()` and `v3d_perfmon_get_values_ioctl()` can copy such freed-memory contents back to userspace, giving kernel memory disclosure.\nI:H - `v3d_perfmon_stop()` writes into the freed object — `mutex_lock()` stores the `current` task pointer into the owner field and `perfmon->values[i] += V3D_CORE_READ(...)` performs a read-modify-write at attacker-chosen offsets — over a slab slot of attacker-chosen size that can be re-occupied by a victim object, yielding a corruption primitive suitable for privilege escalation.\nA:H - Dereferencing the freed perfmon reliably oopses the kernel; the sibling fix for the identical root cause documents a fatal paging fault in `__mutex_lock` from the `v3d_bin` scheduler kthread, killing the GPU pipeline and panicking the machine."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/v3d/v3d_perfmon.c"],"versions":[{"version":"26a4dc29b74a137f45665089f6d3d633fcc9b662","lessThan":"22e19c8c5f6b709f4ae40227392a30d57bac187d","status":"affected","versionType":"git"},{"version":"26a4dc29b74a137f45665089f6d3d633fcc9b662","lessThan":"95036d4c01167568166108d42c2b0e9f8dbd7d2b","status":"affected","versionType":"git"},{"version":"26a4dc29b74a137f45665089f6d3d633fcc9b662","lessThan":"eb0e0eca0eab93f310c6c37b8564049366704691","status":"affected","versionType":"git"},{"version":"26a4dc29b74a137f45665089f6d3d633fcc9b662","lessThan":"1c5673a2c8926adbb61f340c779b28e18188a8cd","status":"affected","versionType":"git"},{"version":"26a4dc29b74a137f45665089f6d3d633fcc9b662","lessThan":"f8805b12f477bd964e2820a87921c7b58cc2dee3","status":"affected","versionType":"git"},{"version":"26a4dc29b74a137f45665089f6d3d633fcc9b662","lessThan":"21f1435b1e6b012a07c42f36b206d2b66fc8f13b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/v3d/v3d_perfmon.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.179","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.129","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.79","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.16","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.4","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.13.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/22e19c8c5f6b709f4ae40227392a30d57bac187d"},{"url":"https://git.kernel.org/stable/c/95036d4c01167568166108d42c2b0e9f8dbd7d2b"},{"url":"https://git.kernel.org/stable/c/eb0e0eca0eab93f310c6c37b8564049366704691"},{"url":"https://git.kernel.org/stable/c/1c5673a2c8926adbb61f340c779b28e18188a8cd"},{"url":"https://git.kernel.org/stable/c/f8805b12f477bd964e2820a87921c7b58cc2dee3"},{"url":"https://git.kernel.org/stable/c/21f1435b1e6b012a07c42f36b206d2b66fc8f13b"}],"title":"drm/v3d: Stop active perfmon if it is being destroyed","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T19:34:21.647Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-09-08T08:40:07.491Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}]}]}}