CVE-2024-42259

What it actually does

Incorrect calculation of virtual memory mapping start and end addresses in the i915 GEM driver ignores partial mapping offsets, allowing the mapped size to be derived incorrectly and triggering page faults on access.

Why it matters to the business

Systems using Intel graphics may experience unexpected crashes or loss of graphics functionality, reducing availability of Linux desktops, servers, and workstations until patched.

How an attack unfolds

A local attacker crafts mmap operations on i915 GEM objects that exercise the faulty boundary math, causing the kernel to reference invalid pages and induce page faults that can be leveraged for denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 3e06073d24807f04b4694108a8474decb7b99e60 or later; for xorg-x11-server-Xwayland on AlmaLinux 9 update to 21.1.3-3.el9 or newer.

How to confirm the fix worked

Verify the running kernel contains the corrected address calculation logic; confirm absence of the prior commit 60a2066c5005 and test mmap operations with partial offsets to ensure no page faults occur.

Typical attack path

1. Local process issues mmap syscall against an i915 framebuffer or GEM object with a non-zero offset
2. Driver computes start/end addresses without accounting for the offset
3. Resulting mapping size is too small or misaligned
4. Subsequent memory access triggers page fault and potential kernel oops or crash

How to detect it

Review kernel logs for i915 GEM page fault messages or oops reports referencing virtual memory mapping; correlate with processes performing graphics mmap operations.

What your security team should do

• Apply the listed kernel and Xwayland updates as soon as possible
• Prioritize patching on systems with Intel i915 graphics hardware
• Monitor system logs for i915-related page faults until patches are deployed