CVE-2024-36944: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36944 is a vulnerability in the Linux kernel's QXL graphics driver that was discovered in May 2024. The issue stems from a circular locking dependency between the console_owner locking and the worker pool locking in the drm/qxl driver, which can cause system hangs during boot (Kernel Git).

The vulnerability was introduced by a commit attempting to simplify qxl_fence_wait functionality. The problematic code created a deadlock situation between console_owner and worker pool locks, causing system hangs during boot with symptoms including a timeout after 60 seconds during trace event testing. The issue was confirmed through testing in virtual machine environments (Kernel Git). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability can cause affected systems to hang during boot, preventing normal system operation. While the fix may result in '[TTM] Buffer eviction failed' messages, this was deemed preferable to having non-booting systems (Kernel Git).

The vulnerability requires local access and can be triggered during system boot when using the QXL graphics driver in virtual machine environments. No known exploits in the wild have been reported (NVD).

The issue has been fixed in multiple Linux kernel versions including 6.8.0-40.40 for Ubuntu 24.04 LTS, 5.15.0-118.128 for Ubuntu 22.04 LTS, and various other kernel versions for different Ubuntu releases. The fix involves reverting a previous commit that attempted to simplify qxl_fence_wait functionality (Ubuntu Security).