CVE-2024-40926

What it actually does

Uninitialized hpd_work and hpd_lock on headless NVIDIA GPUs cause a BUG when nouveau attempts to schedule hpd_work during runtime PM resume.

Why it matters to the business

Systems using certain NVIDIA GPUs without display outputs may experience kernel crashes triggered by power management events, resulting in unplanned downtime and potential data loss on affected Linux servers or workstations.

How an attack unfolds

An attacker with local access or the ability to influence runtime power management on a vulnerable system can trigger PM resume events on a headless nouveau device, causing the kernel to hit the uninitialized work item and panic.

How to fix it

Update the Linux kernel to a version containing commit 227349998e5740f14d531b0f0d704e66b1ed3c2f or later; apply the headless flag check to skip HPD handling on cards without display hardware.

How to confirm the fix worked

Confirm the kernel source contains the headless flag logic and that nouveau skips hpd_work scheduling on devices without display hardware; test runtime PM resume on headless GPU configurations.

Typical attack path

1. Identify or control a Linux system with a headless NVIDIA GPU using the nouveau driver
2. Trigger runtime PM resume (via power management, suspend/resume cycles, or workload changes)
3. nouveau attempts to schedule hpd_work without prior initialization
4. Kernel hits BUG and panics, resulting in denial of service

How to detect it

Review kernel logs for BUG reports mentioning hpd_work or nouveau during PM resume events; correlate with dmesg entries showing runtime PM activity on NVIDIA devices.

What your security team should do

• Prioritize kernel updates on systems with NVIDIA GPUs that may operate headless
• Monitor for nouveau-related kernel panics in system logs
• Disable runtime PM for nouveau if immediate patching is not feasible