CVE-2024-35829

What it actually does

Failure to deallocate resources when lima_vm_map_bo fails inside lima_heap_alloc, causing a kernel memory leak in the lima DRM driver.

Why it matters to the business

Gradual memory exhaustion on Linux systems using the lima graphics driver for ARM Mali GPUs, leading to performance degradation or instability during prolonged operation; low urgency given absence from KEV and stable low EPSS.

How an attack unfolds

An attacker triggers repeated failure paths in lima_vm_map_bo through crafted buffer or VM mapping operations in the lima driver; each failure leaks memory because cleanup is skipped, accumulating until system resources are depleted.

How to fix it

Update the Linux kernel to include commit f2e80ac9344aebbff576453d5c0290b332e187ed which adds the missing deallocation in the lima_heap_alloc error path.

How to confirm the fix worked

Inspect the lima_heap_alloc function to confirm resource release logic exists after the lima_vm_map_bo failure check; verify the fixed commit is present in the running kernel source or binary.

Typical attack path

1. Obtain local or graphics-context access on a system using the lima driver
2. Craft operations that cause lima_vm_map_bo to return failure inside lima_heap_alloc
3. Repeat the triggering sequence to accumulate unreleased kernel memory
4. Observe system-wide memory pressure or OOM conditions over time

How to detect it

Review kernel logs and memory accounting for repeated lima driver allocation paths without matching frees; correlate with graphics workload activity that exercises VM mapping failures.

What your security team should do

• Apply the kernel fix containing commit f2e80ac9344aebbff576453d5c0290b332e187ed on all affected systems
• Prioritize updates on devices relying on the lima DRM driver
• Monitor kernel memory usage metrics for unexplained growth in graphics subsystems