CVE-2024-27400

What it actually does

Incorrect call order in amdgpu_ttm_move() performs move notifications after buffer relocation, leaving old locations invalid for DMA-buf and VM handling while also updating eviction statistics prematurely and creating a race condition.

Why it matters to the business

AMD GPU systems may experience kernel instability, crashes, or potential memory corruption during graphics or compute workloads, increasing downtime risk and necessitating kernel updates across fleets with high ecosystem prevalence.

How an attack unfolds

An attacker with local access triggers repeated TTM buffer moves on AMD GPUs to hit the notification ordering window, potentially causing use-after-free or invalid state in DMA-buf/VM paths; listed Android kernel threat actor context does not apply to this Linux driver flaw.

How to fix it

Update the Linux kernel in org/pub/scm/linux/kernel/git/torvalds/linux.git to commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or later.

How to confirm the fix worked

Confirm the fix commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 is present in the kernel tree and test amdgpu_ttm_move paths under load for correct notification ordering and NULL checks.

Typical attack path

1. Gain local code execution on a system with AMD GPU
2. Trigger amdgpu buffer allocation and move operations via graphics or compute workloads
3. Exploit window where notifications reference freed old locations
4. Achieve memory corruption or denial of service

How to detect it

Review kernel logs and ftrace output for amdgpu_bo_move events or TTM relocation errors around the time of crashes; correlate with process activity using AMD GPUs.

What your security team should do

• Prioritize kernel upgrades to the fixed commit within standard patch cycles given low EPSS and no KEV status
• Monitor amdgpu driver stability in production workloads
• Review downstream dependent packages for kernel updates