Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp): The GSP message-queue read pointer is advanced by the wrong

Impact

The GSP message-queue read pointer is advanced by the wrong amount, so the driver parses message body bytes as a header, underflows the copy-length computation to a ~0xffffffff value and then dereferences a NULL message pointer. Oversized copy plus kernel panic - the node goes down for every tenant sharing it.

Who can reach it

Same GSP RPC path as CVE-2024-58018: two-page GSP event messages generated during normal tenant-driven GPU activity on a nouveau/GSP-firmware NVIDIA GPU. A tenant holding /dev/dri/renderD* supplies the workload that produces those messages; no capabilities required. Not applicable when the NVIDIA vendor module is in use.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: run the vendor kernel module rather than nouveau on shared GSP-class GPUs.

References