CVE-2024-35928

What it actually does

Failure to release ioremap mappings for adev->rmmio on early error exits in amdgpu_device_init leads to unreleased kernel memory mappings.

Why it matters to the business

Systems using affected AMD GPU drivers on Debian may experience gradual memory exhaustion during repeated device initialization failures, increasing operational risk and potential downtime until patched kernels are deployed.

How an attack unfolds

An attacker with local access or the ability to induce driver reload errors could trigger the leak paths repeatedly to exhaust memory mappings; listed threat actor references do not align with this kernel initialization flaw.

How to fix it

Upgrade to linux 6.1.90-1 or newer on Debian 12 and linux 6.8.9-1 or newer on Debian 13; apply the fixed kernel packages and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the listed fixed versions and verify amdgpu_device.c no longer contains the reported early-return leak paths via source inspection or distro package changelog.

Typical attack path

1. Gain local access or ability to force amdgpu device reinitialization
2. Induce error conditions in amdgpu_device_init to hit early return paths
3. Repeat to accumulate leaked ioremap mappings
4. Trigger system memory pressure or instability

How to detect it

Review kernel logs for amdgpu_device_init error exits without corresponding iounmap activity; no specific post-exploitation artifacts are present because the issue occurs only during driver initialization.

What your security team should do

• Prioritize kernel updates on all Debian systems using amdgpu driver within standard change windows
• Monitor for repeated amdgpu initialization failures in system logs
• Test updated kernels in staging environments before broad rollout