Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Linux kernel 6.6.157.1-1 may mishandle device removal

published 2 years ago
Summary

The Linux kernel version 6.6.157.1-1 could fail to clear certain memory-mapped I/O settings when a device is removed, potentially allowing unintended access to stale addresses. This could lead to instability or data corruption if malicious code exploits the leftover mappings. Updating the kernel to the latest patched version resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure kernel <= 6.6.150.1-1
Azure Linux:3 – kernel <= 6.6.157.1-1
<= 6.6.152.1-1
Original advisory text
CVE-2024-46705 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: reset mmio mappings with devm

Set our various mmio mappings to NULL. This should make it easier to
catch something rogue trying to mess with mmio after device removal. For
example, we might unmap everything and then start hitting some mmio
address which has already been unmamped by us and then remapped by
something else, causing all kinds of carnage.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Timeline
Published13 Sep 2024
Updated24 Sep 2026
First seen23 Sep 2026
Sources
AZL-49321 · OSV
Track software like this
Free during beta