CVE-2024-56544

What it actually does

The udmabuf driver uses kmalloc for a page pointer array that cannot exceed 4 MB (524288 entries) due to MAX_PAGE_ORDER limits on 64-bit systems, causing __alloc_pages to warn and return NULL for larger requests such as 3 GB buffers.

Why it matters to the business

Applications that rely on large DMA buffers fail to allocate them, resulting in service disruption for media processing, graphics, or virtualization workloads that depend on udmabuf.

How an attack unfolds

An attacker invokes udmabuf_create with a size that exceeds the kmalloc limit (for example by setting the limit to 3072 pages and requesting a 3 GB buffer), triggering the page allocator warning and allocation failure path shown in the stack trace.

How to fix it

Upgrade the Linux kernel to the commit that replaces kmalloc_array with kvmalloc_array (2acc6192aa8570661ed37868c02c03002b1dc290) so that the allocation can fall back to vmalloc for large arrays.

How to confirm the fix worked

Confirm the presence of kvmalloc_array in udmabuf_create and test allocation of buffers larger than 2 GB; verify that no WARNING from __alloc_pages is emitted.

Typical attack path

1. Identify a process or interface that can call udmabuf_create with user-controlled size parameters
2. Request creation of a udmabuf whose page array exceeds 4 MB
3. Observe kernel warning and NULL return from __alloc_pages
4. Cause the udmabuf creation to fail, denying the intended DMA buffer to legitimate users

How to detect it

Search kernel logs for the exact WARNING string from __alloc_pages triggered by udmabuf_create and for the call trace containing udmabuf_create+0x131.

• WARNING: CPU:.*PID:.*at mm/page_alloc.c.*__alloc_pages
• udmabuf_create+0x131/0x400
• udmabuf: change folios array from kmalloc to kvmalloc

What your security team should do

• Apply the kvmalloc_array fix to all kernel builds that include udmabuf
• Monitor kernel logs for the __alloc_pages warning associated with udmabuf_create
• Restrict unprivileged access to udmabuf creation where possible until patched