CVE-2024-40976

What it actually does

Race condition in lima DRM driver timeout handler where a rendering job completes after the drm sched timeout but before hard reset, causing refcount imbalance on lima_pm_idle and kernel warnings.

Why it matters to the business

Potential instability, warnings, or degraded graphics performance on Linux systems using lima GPU hardware; low urgency due to absent KEV status and flat EPSS trend but still requires patching to avoid operational issues in graphics workloads.

How an attack unfolds

An attacker triggers carefully timed rendering jobs on lima hardware to hit the timeout handler race; listed threat actors in zero-day and Linux kernel campaigns could leverage similar kernel timing issues though this specific flaw primarily produces stability problems rather than direct code execution.

How to fix it

Update the Linux kernel to include commit 03e7b2f7ae4c0ae5fb8e4e2454ba4008877f196a which masks IRQs early in the timeout handler; apply the fixed version available in the stable git repository.

How to confirm the fix worked

Confirm kernel source contains commit 03e7b2f7ae4c0ae5fb8e4e2454ba4008877f196a; reproduce workload that previously triggered timeout and verify absence of lima_devfreq_record_idle warnings.

Typical attack path

1. Submit GPU rendering workload that exceeds job timeout threshold
2. Allow job to complete after timeout handler starts but before hard reset
3. Trigger IRQ path leading to lima_devfreq_record_idle after refcount state is inconsistent
4. Observe kernel warning and stack trace in logs

How to detect it

Search kernel logs and dmesg for strings matching lima_devfreq_record_idle, lima_sched_pipe_task_done, or the associated WARNING and call trace involving lima_gp_irq_handler.

• lima_devfreq_record_idle+0xa0/0xb0
• lima_sched_pipe_task_done+0x5c/0xb0
• WARNING: CPU:.*at drivers/gpu/drm/lima/lima_devfreq.c:205

What your security team should do

• Prioritize kernel update on systems with lima GPU hardware
• Add monitoring for lima-related kernel warnings in logging infrastructure
• Test graphics workloads after patching to confirm race is resolved