CVE-2024-36018

What it actually does

Incorrect start/end calculations in nouveau UVMM remap operations produce oversized unmap requests that corrupt GPU pagetables and trigger kernel oops.

Why it matters to the business

Systems using the Nouveau driver experience sudden kernel crashes during graphics workloads, leading to downtime, loss of GPU acceleration, and potential data loss in rendering or compute jobs.

How an attack unfolds

An attacker or unprivileged user triggers a specific Vulkan sparse-resource rebind sequence that exercises the faulty remap path; the kernel then performs an out-of-bounds unmap, corrupting pagetables and crashing the system.

How to fix it

Update the Linux kernel to a version containing commit 692a51bebf4552bdf0a79ccd68d291182a26a569 or later; rebuild and reboot with the patched kernel; test Nouveau workloads to confirm stability.

How to confirm the fix worked

Verify the running kernel contains commit 692a51bebf4552bdf0a79ccd68d291182a26a569 via git log or package version; reproduce the original deqp test case and confirm no oops occurs; monitor dmesg for absence of UVMM remap corruption messages.

Typical attack path

1. Obtain local access or run unprivileged graphics code on a Nouveau-equipped system
2. Issue a crafted deqp-style sparse image rebind that produces the observed prev/next remap pattern
3. Trigger the buggy unmap calculation that spans an extra 0x100000 range
4. Observe kernel oops and system instability or reboot

How to detect it

Inspect dmesg and kernel logs for nouveau UVMM remap warnings or oopses containing addresses near 0x3fffed0000; correlate with process activity using Vulkan sparse resources; review audit logs for recent graphics driver loads.

What your security team should do

• Prioritize kernel upgrade on all systems exposing Nouveau to untrusted users or workloads
• Apply the fix within normal patch windows unless the host is reachable by unprivileged graphics clients
• Add the patched commit hash to internal kernel build and distribution pipelines
• Monitor for future Nouveau UVMM changes that touch remap address calculations