CVE-2024-26657: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2024-26657) was discovered in the Linux kernel's DRM scheduler component. The vulnerability affects Linux kernel versions from 6.7 up to (excluding) 6.7.12 and from 6.8 up to (excluding) 6.8.3, as well as version 6.9-rc1. The issue was reported by Joonkyo Jung and can be triggered by sending an amdgpu_cs_wait_ioctl to the AMDGPU DRM driver on any ASICs with valid context (NVD).

The vulnerability occurs in the drm_sched_entity_init function within the GPU scheduler component. The issue stems from a logic modification in commit 1decbf6bb0b4dc56c9da6c5e57b994ebfc2be3aa that allowed sched_rq to be NULL. When an AMDGPU_WAIT_CS ioctl is called without a previously submitted job, instead of returning an error, the function attempts to dereference a NULL pointer, leading to a kernel crash. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability can cause a denial of service condition through a kernel crash. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability can be triggered by a local attacker with low privileges. A proof-of-concept exploit exists that demonstrates how to trigger the vulnerability using specific AMDGPU driver ioctls (Kernel Patch).

The vulnerability has been fixed in Linux kernel versions 6.7.12, 6.8.3, and later. Users should update their kernel to these patched versions. The fix involves modifying the check in drm_sched_entity_init to properly handle cases where the scheduler is not initialized (Kernel Patch).