CVE-2024-41094

What it actually does

The flaw causes fb_info.fix.smem_start to be set for DMA framebuffers backed by vmalloc address space, resulting in virt_to_phys calls on non-linear addresses and incorrect assumptions of physical memory contiguity during DRM fbdev DMA initialization on affected kernels.

Why it matters to the business

Kernel warnings or potential instability may occur on ARM64 systems using DRM with vmalloc-backed DMA memory, impacting display initialization and graphics functionality in embedded or specialized hardware environments.

How an attack unfolds

An attacker triggers DRM fbdev DMA client hotplug or initial framebuffer configuration on vulnerable kernels to invoke the faulty smem_start logic, surfacing the virt_to_phys warning; no public exploits or threat actors are associated with this issue.

How to fix it

Update the Linux kernel to the fixed commit f29fcfbf6067c0d8c83f84a045da9276c08deac5 or later stable versions containing the drm_leak_fbdev_smem module option check.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source and verify absence of virt_to_phys warnings during drm_fbdev_dma_setup on test hardware with vmalloc DMA memory.

Typical attack path

1. Trigger DRM framebuffer setup via hotplug or client registration on affected hardware
2. Allocate DMA memory from vmalloc address space
3. Invoke drm_fbdev_dma_helper_fb_probe leading to virt_to_phys on non-linear address

How to detect it

Inspect kernel logs for warnings from arch/arm64/mm/physaddr.c or drm_fbdev_dma_helper_fb_probe during early boot and deferred probe work on systems using DRM fbdev DMA.

• virt_to_phys used for non-linear address
• WARNING: CPU:.* at arch/arm64/mm/physaddr.c
• drm_fbdev_dma_helper_fb_probe
• __virt_to_phys+0x68/0x98

What your security team should do

• Prioritize kernel updates on affected ARM64 systems using DRM fbdev DMA
• Monitor kernel logs for related warnings during system boot and graphics initialization
• Test framebuffer functionality post-update on representative hardware