CVE-2024-53078

What it actually does

The probe routine in drm/tegra performed a NULL check on the result of iommu_paging_domain_alloc() instead of an IS_ERR() check, allowing an error pointer to be dereferenced or a valid pointer to be treated as an error.

Why it matters to the business

Systems using the affected Linux kernel graphics driver may experience probe failures, driver instability, or unintended code paths that could be leveraged in local attacks; urgency is low given the absence of KEV listing and flat EPSS trend.

How an attack unfolds

An attacker with local access triggers IOMMU domain allocation failure during device probe on Tegra hardware; the incorrect check causes the driver to mishandle the returned error pointer, potentially leading to a crash or use of an invalid domain object.

How to fix it

Apply the upstream fix that replaces the NULL check with IS_ERR() in the drm/tegra probe path; for the listed flashplugin-nonfree packages on Ubuntu 14.04 LTS, update to version 11.2.202.559ubuntu0.14.04.1 or later.

How to confirm the fix worked

Confirm the corrected IS_ERR() check is present in the drm/tegra source after patching; verify the driver loads without probe errors on Tegra hardware and that no NULL-vs-error-pointer warnings appear in kernel logs.

Typical attack path

1. Obtain local access on a system with the vulnerable drm/tegra driver
2. Trigger IOMMU paging domain allocation that returns an error pointer
3. Rely on the NULL check passing to dereference the error pointer
4. Cause kernel panic, driver malfunction, or reach attacker-controlled state

How to detect it

Search kernel logs for drm/tegra probe failures around iommu_paging_domain_alloc calls and review dmesg or journalctl output for NULL pointer dereference or invalid domain warnings on Tegra platforms.

What your security team should do

• Prioritize patching the Linux kernel on any Tegra-based systems within normal maintenance windows
• Monitor EPSS and KEV updates for this CVE given the listed threat actor campaigns
• Audit custom kernels or out-of-tree drm/tegra modules for the same error-checking pattern