{"id":"CVE-2024-44982","summary":"drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: cleanup FB if dpu_format_populate_layout fails\n\nIf the dpu_format_populate_layout() fails, then FB is prepared, but not\ncleaned up. This ends up leaking the pin_count on the GEM object and\ncauses a splat during DRM file closure:\n\nmsm_obj-\u003epin_count\nWARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc\n[...]\nCall trace:\n update_lru_locked+0xc4/0xcc\n put_pages+0xac/0x100\n msm_gem_free_object+0x138/0x180\n drm_gem_object_free+0x1c/0x30\n drm_gem_object_handle_put_unlocked+0x108/0x10c\n drm_gem_object_release_handle+0x58/0x70\n idr_for_each+0x68/0xec\n drm_gem_release+0x28/0x40\n drm_file_free+0x174/0x234\n drm_release+0xb0/0x160\n __fput+0xc0/0x2c8\n __fput_sync+0x50/0x5c\n __arm64_sys_close+0x38/0x7c\n invoke_syscall+0x48/0x118\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x4c/0x120\n el0t_64_sync_handler+0x100/0x12c\n el0t_64_sync+0x190/0x194\nirq event stamp: 129818\nhardirqs last  enabled at (129817): [\u003cffffa5f6d953fcc0\u003e] console_unlock+0x118/0x124\nhardirqs last disabled at (129818): [\u003cffffa5f6da7dcf04\u003e] el1_dbg+0x24/0x8c\nsoftirqs last  enabled at (129808): [\u003cffffa5f6d94afc18\u003e] handle_softirqs+0x4c8/0x4e8\nsoftirqs last disabled at (129785): [\u003cffffa5f6d94105e4\u003e] __do_softirq+0x14/0x20\n\nPatchwork: https://patchwork.freedesktop.org/patch/600714/","modified":"2026-04-02T12:18:36.244385Z","published":"2024-09-04T19:54:32.158Z","related":["MGASA-2024-0309","MGASA-2024-0310","SUSE-SU-2024:3551-1","SUSE-SU-2024:3553-1","SUSE-SU-2024:3559-1","SUSE-SU-2024:3561-1","SUSE-SU-2024:3564-1","SUSE-SU-2024:3566-1","SUSE-SU-2024:3569-1","SUSE-SU-2024:3587-1","SUSE-SU-2024:3591-1","SUSE-SU-2024:3592-1","SUSE-SU-2025:20073-1","SUSE-SU-2025:20077-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/44xxx/CVE-2024-44982.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/02193c70723118889281f75b88722b26b58bf4ae"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7ecf85542169012765e4c2817cd3be6c2e009962"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9b8b65211a880af8fe8330a101e1e239a2d4008f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bfa1a6283be390947d3649c482e5167186a37016"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/44xxx/CVE-2024-44982.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44982"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef"},{"fixed":"9b8b65211a880af8fe8330a101e1e239a2d4008f"},{"fixed":"7ecf85542169012765e4c2817cd3be6c2e009962"},{"fixed":"a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d"},{"fixed":"02193c70723118889281f75b88722b26b58bf4ae"},{"fixed":"bfa1a6283be390947d3649c482e5167186a37016"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-44982.json"}}],"schema_version":"1.7.5"}