CVE-2024-35951

What it actually does

Incorrect page reference counting on allocation failure in panfrost_mmu_map_fault_addr allows unbalanced get/put_pages calls that leave dangling references, enabling use-after-free on subsequent fault handling or BO destruction.

Why it matters to the business

Local attackers on affected Linux kernels with Panfrost GPUs can trigger kernel crashes or memory corruption; high ecosystem prevalence in Android devices increases urgency for patch deployment before public exploit maturity rises.

How an attack unfolds

An attacker with local access triggers GPU fault handling in the Panfrost driver; when page or scatter-gather table allocation fails, the error path erroneously drops earlier page references, leaving the BO in an inconsistent state that a subsequent fault or object release can turn into a use-after-free primitive, potentially leading to kernel code execution as noted in Android kernel RCE contexts.

How to fix it

Upgrade the Linux kernel to the commit 31806711e8a4b75e09b1c43652f2a6420e6e1002 or later stable releases that include the corrected error path; apply the patch immediately on Android devices and other Panfrost deployments given the 877-day exposure window.

How to confirm the fix worked

Verify the running kernel contains commit 31806711e8a4b75e09b1c43652f2a6420e6e1002 via git log or kernel version string; confirm absence of the unbalanced put_pages logic by inspecting the panfrost_mmu.c source around the fault-mapping function.

Typical attack path

1. Obtain local unprivileged access on a Panfrost-equipped Linux system
2. Trigger repeated GPU memory mapping faults that exercise the allocation-failure path in panfrost_mmu_map_fault_addr
3. Force the driver into the buggy error path to create dangling page references
4. Re-trigger fault handling or destroy the BO to dereference freed memory
5. Leverage the resulting use-after-free for privilege escalation or denial of service

How to detect it

Search kernel logs for Panfrost MMU fault messages combined with allocation-failure paths; inspect for repeated unbalanced page reference warnings or use-after-free reports in dmesg and kernel crash dumps; correlate with process activity that exercises GPU memory mapping on affected Android or Linux kernels.

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all Panfrost/Android fleets within the next maintenance window
• Monitor EPSS trend and any new threat-actor activity for this Use-After-Free class
• Harden local access controls and enable kernel hardening features such as KASAN or page-table isolation until patches are applied