CVE-2024-44993

What it actually does

Out-of-bounds read in v3d_csd_job_run() by indexing the eighth element of a __u32[7] array supplied via UAPI, triggered during DRM job scheduling on V3D hardware.

Why it matters to the business

Systems using affected V3D GPUs (such as Raspberry Pi 5) risk kernel crashes or limited information disclosure until updated, increasing downtime and potential exposure on graphics workloads; prevalence in embedded and Linux distributions amplifies patch urgency.

How an attack unfolds

A local attacker submits a CSD job through the DRM UAPI that causes the gpu_sched workqueue to invoke v3d_csd_job_run(), which performs an out-of-bounds array access; the read may leak kernel memory or trigger a UBSAN fault leading to denial of service.

How to fix it

Apply the upstream kernel fix from commit d656b82c4b30cf12715e6cd129d3df808fde24a7; update to a stable release containing this change and rebuild any custom kernels or distributions that include the v3d driver.

How to confirm the fix worked

Confirm the running kernel contains commit d656b82c4b30cf12715e6cd129d3df808fde24a7 or equivalent; enable UBSAN and exercise V3D CSD workloads to verify absence of the array-index-out-of-bounds warning in v3d_sched.c.

Typical attack path

1. Obtain local user access on an affected Linux system with V3D GPU
2. Craft and submit a CSD job via the DRM V3D UAPI that references beyond seven configuration registers
3. Allow the scheduler workqueue to execute v3d_csd_job_run()
4. Trigger the out-of-bounds read resulting in kernel fault or data exposure

How to detect it

Search kernel logs (dmesg, journalctl) for UBSAN array-index-out-of-bounds warnings citing v3d_sched.c:320 or v3d_csd_job_run; correlate with unexpected GPU job failures or kernel panics on V3D hardware.

What your security team should do

• Prioritize kernel updates on all V3D-equipped devices within the next maintenance window
• Restrict unprivileged access to /dev/dri/renderD* nodes until patched
• Add monitoring for UBSAN or kernel oops messages referencing v3d_csd_job_run