CVE-2024-39497: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-12 · updated 2026-06-17
Weakness: CWE-617

Description

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Lack of check for copy-on-write (COW) mapping in drm_gem_shmem_mmap allows users to call mmap with PROT_WRITE and MAP_PRIVATE flag causing a kernel panic due to BUG_ON in vmf_insert_pfn_prot: BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags)); Return -EINVAL early if COW mapping is detected. This bug affects all drm drivers using default shmem helpers. It can be reproduced by this simple example: void *ptr = mmap(0, size, PROT_WRITE, MAP_PRIVATE, fd, mmap_offset); ptr[0] = 0;

Affected products

Linux kernel: from 5.2 before 5.10.229; from 5.11 before 5.15.169; from 5.16 before 6.1.114; from 6.2 before 6.6.35; from 6.7 before 6.9.6; 6.10-rc1 — fixed in 5.10.229, 5.15.169, 6.1.114, 6.6.35, 6.9.6

How to fix

Upgrade to a fixed version: Linux kernel 5.10.229, 5.15.169, 6.1.114, 6.6.35. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-39497 or the next vulnerability affects your stack