CVE-2024-43863

What it actually does

Deadlock in dma-buf fence polling within the vmwgfx driver caused by lock ordering between the wait callback (which holds the pending-fence list lock while signaling) and the fence destroy callback (which attempts to acquire the same lock on release).

Why it matters to the business

Applications using DMA-BUF polling interfaces can trigger kernel-level stalls or deadlocks, disrupting desktop environments and graphics workloads on affected Linux systems; widespread kernel presence increases exposure across servers and workstations.

How an attack unfolds

An attacker or unprivileged process triggers dma-buf polling on a vmwgfx fence; the poll wait path acquires the pending list lock, signals fences, and then the destroy path attempts to acquire the same lock, resulting in deadlock. Listed threat actors in zero-day and Linux kernel campaigns could leverage similar resource-handling flaws for denial-of-service or to disrupt target systems.

How to fix it

Update the Linux kernel to a version containing commit 9908dc0d2ef0e4aec8a242c098455729c0e2f017 or later stable releases; rebuild and deploy kernels for all affected distributions; test dma-buf polling workloads post-update.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or package; exercise dma-buf polling paths under load and verify absence of deadlocks; monitor for updated package versions across distributions.

Typical attack path

1. Identify or craft userspace code that exercises dma-buf polling on vmwgfx resources
2. Invoke poll() or equivalent on a fence-backed buffer
3. Trigger concurrent fence signaling and destruction paths
4. Induce lock contention leading to deadlock

How to detect it

Review kernel logs for deadlock traces involving vmwgfx fence lists or dma-buf polling; inspect process activity around graphics buffer sharing; correlate with threat actor activity targeting Linux kernel resource issues.

What your security team should do

• Prioritize kernel upgrades on systems running KDE or other dma-buf polling consumers
• Apply the fix within standard patching windows given low EPSS and non-KEV status
• Monitor upstream stable kernel releases for backports
• Test graphics and desktop workloads after deployment