Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/instmem): Concurrent GPU work races the instance-memory pointer

Impact

Concurrent GPU work races the instance-memory pointer stores used while walking GPU page tables, and the kernel dereferences a torn pointer. One tenant's ordinary parallel workload oopses the kernel and takes the whole node down with every other tenant on it.

Who can reach it

Unprivileged tenant holding /dev/dri/renderD* on a nouveau device, running many concurrent submissions - a parallel Vulkan conformance-style load reproduced it within hours on stock hardware. No special capabilities, no device misconfiguration required. nouveau only.

What to do

Update to a stable kernel carrying the fix (no fixed_in published in the record; use the stable commits below). Interim: keep nouveau off shared GPU nodes, or drop /dev/dri from tenant containers on nouveau-driven hosts.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDCVE-2024-26986 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel (drivers/vfio/pci): For passthrough devices whose INTx has to be masked at the irqchip, the IRQ is enabledCVE-2024-27437 · Linux kernel (drivers/vfio/pci)Medium
• Linux kernel (drivers/gpu/drm/nouveau): Calling the legacy pushbuf submission ioctl on a client that has VM_BINDCVE-2024-35786 · Linux kernel (drivers/gpu/drm/nouveau)Medium
• Linux kernel (net/tls): Splice with MSG_SPLICE_PAGES and MSG_MORE could push more pages into the plaintext scatterlistCVE-2024-35841 · Linux kernel (net/tls)Medium
• Linux kernel (net/tls): Tls_init published the new sk_prot before the TLS context was fully initialized, so aCVE-2024-36489 · Linux kernel (net/tls)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): Missing or insufficient validation of user-suppliedCVE-2024-36951 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium