CVE-2024-40988

What it actually does

Missing bounds check on sumo_vid_mapping_entry array index in kv_dpm.c allows out-of-bounds access during Radeon power management calculations.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems using affected Radeon GPUs, increasing operational risk and patching urgency across server and desktop fleets.

How an attack unfolds

An attacker with local access crafts inputs that cause the sumo_vid_mapping_entry calculation to exceed array bounds, triggering undefined behavior that can be leveraged for memory corruption or denial of service.

How to fix it

Update the Linux kernel to the fixed commit 07e8f15fa16695cf4c90e89854e59af4a760055b or later stable release containing the bounds check addition.

How to confirm the fix worked

Verify the presence of the bounds check in kv_dpm.c after applying the update and confirm no UBSAN warnings are triggered during Radeon DPM operations on test hardware.

Typical attack path

1. Obtain local code execution on target Linux system
2. Trigger Radeon DPM power state transitions that invoke kv_dpm code path
3. Supply crafted voltage or mapping values that overflow the sumo_vid_mapping_entry index
4. Exploit resulting out-of-bounds memory access for kernel code execution or crash

How to detect it

Review kernel logs for UBSAN warnings or out-of-bounds accesses mentioning kv_dpm.c or sumo_vid_mapping_entry; examine crash dumps showing memory violations in Radeon DPM paths.

What your security team should do

• Apply the kernel fix immediately on all systems with Radeon GPUs
• Prioritize patching for internet-facing or multi-tenant hosts
• Monitor for kernel oops or UBSAN reports related to kv_dpm after deployment