CVE-2024-36960

What it actually does

Incorrect length field in drm_event causes drm_read to copy excess bytes from the parent structure instead of the intended drm_vmw_event_fence, producing an out-of-bounds kernel memory read into user space.

Why it matters to the business

User processes may read adjacent kernel memory, potentially exposing sensitive kernel data; the flaw affects graphics workloads on systems using the vmwgfx driver and requires a kernel update to resolve.

How an attack unfolds

An attacker with local access triggers fence-signaled events through the vmwgfx driver, then calls drm_read on the event file descriptor; because the event length is set too large, the kernel copies data past the intended structure boundary into the caller's buffer.

How to fix it

Upgrade the Linux kernel to a version containing commit 2f527e3efd37c7c5e85e8aa86308856b619fa59f or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel Git commit or version string contains 2f527e3efd37c7c5e85e8aa86308856b619fa59f; exercise drm event paths and verify that only the expected structure size is copied to user space.

Typical attack path

1. Obtain local unprivileged access on a system using the vmwgfx DRM driver
2. Perform graphics or synchronization operations that cause fence signaled events to be queued
3. Invoke drm_read on the associated file descriptor to retrieve events
4. Receive kernel memory beyond the drm_vmw_event_fence structure in the returned buffer

How to detect it

Review kernel logs for drm/vmwgfx warnings around event handling; examine user-space processes that open DRM render nodes and perform fence operations for anomalous event buffer sizes.

What your security team should do

• Prioritize kernel update on systems that load the vmwgfx module
• Apply the fix within standard patch-management windows given the low EPSS score and absence from KEV
• Monitor upstream stable branches for any follow-on corrections