CVE-2024-50096: nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-05 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error The `nouveau_dmem_copy_one` function ensures that the copy push command is sent to the device firmware but does not track whether it was executed successfully. In the case of a copy error (e.g., firmware or hardware failure), the copy push command will be sent via the firmware channel, and `nouveau_dmem_copy_one` will likely report success, leading to the `migrate_to_ram` function returning a dirty HIGH_USER page to the user. This can result in a security vulnerability, as a HIGH_USER page that may contain sensitive or corrupted data could be returned to the user. To prevent this vulnerability, we allocate a zero page. Thus, in case of an error, a non-dirty (zero) page will be returned to the user.

Affected products

Linux kernel: from 5.1 before 5.4.285; from 5.5 before 5.10.227; from 5.11 before 5.15.168; from 5.16 before 6.1.113; from 6.2 before 6.6.57; from 6.7 before 6.11.4 — fixed in 5.10.227, 5.15.168, 5.4.285, 6.1.113, 6.11.4, 6.6.57

How to fix

Upgrade to a fixed version: Linux kernel 5.10.227, 5.15.168, 5.4.285, 6.1.113. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50096 or the next vulnerability affects your stack