CVE-2024-53116

What it actually does

Incorrect offset handling during partial GPU buffer object unmapping across multiple scatterlists in the Panthor DRM driver leads to incomplete page table unmaps, triggering kernel warnings in io-pgtable-arm and panthor_mmu.

Why it matters to the business

Systems using the Panthor GPU driver may experience graphics instability, kernel log spam, and potential denial of service during GPU memory operations; high ecosystem prevalence in Linux distributions increases exposure for graphics workloads.

How an attack unfolds

An attacker triggers repeated DRM VM bind/unbind ioctls that request partial unmaps spanning scatterlists with non-zero offsets, causing the uncleared offset variable to produce incorrect unmap ranges and kernel warnings.

How to fix it

Upgrade the Linux kernel to a version containing commit d3e61af64b770e0038470c81f42bd1d0598f6bcc or later; apply distribution-specific kernel updates that include the Panthor partial mapping fix.

How to confirm the fix worked

Verify the presence of commit d3e61af64b770e0038470c81f42bd1d0598f6bcc in the running kernel source; reproduce GPU mapping workloads and confirm absence of the drm_WARN_ON and failed unmap messages.

Typical attack path

1. Identify a system with the Panthor driver loaded
2. Craft and submit DRM ioctl sequences for GPU VA unmapping of buffer objects
3. Ensure partial mappings span multiple scatterlists with offset not at first page
4. Observe resulting kernel warnings and failed unmap operations

How to detect it

Search kernel logs and dmesg for the strings drm_WARN_ON(unmapped_sz != pgsize * pgcount), failed to unmap range, and the call trace involving panthor_vm_unmap_pages and __arm_lpae_unmap; correlate with processes issuing DRM ioctls.

• drm_WARN_ON(unmapped_sz != pgsize * pgcount)
• failed to unmap range
• panthor_vm_unmap_pages
• __arm_lpae_unmap
• panthor_gpuva_sm_step_unmap

What your security team should do

• Prioritize kernel updates on all systems using the Panthor driver
• Monitor kernel logs for the specific Panthor unmap warnings as an interim detection measure
• Test graphics workloads after patching to confirm stability