CVE-2024-40924: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40924 affects the Linux kernel's DPT (Display Page Table) object handling in the Intel i915 graphics driver. The vulnerability was discovered and disclosed on July 12, 2024. The issue occurs when the DPT object gets shrunk while the actual framebuffer remains on the DPT's vm->bound_list, leading to attempts to rewrite PTEs via a stale CPU mapping which can cause system panic (Kernel Git).

The vulnerability stems from a race condition in the DPT object shrinking mechanism. When the DPT object is shrunk but the associated framebuffer remains bound, the system attempts to rewrite Page Table Entries (PTEs) using an invalid CPU mapping. This condition was introduced by commit 0dc987b699ce which added smem fallback allocation for DPT. The fix involves making the DPT object unshrinkable by modifying the i915_gem_object_is_shrinkable() function to check for the is_dpt flag (Kernel Git).

When exploited, this vulnerability can cause a system panic, resulting in a denial of service condition. The issue specifically affects systems using the Intel i915 graphics driver with DPT functionality (NVD).

The vulnerability requires local access to a system running the affected Linux kernel version with Intel i915 graphics driver. It can be triggered through specific DPT object operations that cause the shrinking condition (Kernel Git).

The issue has been fixed in various Linux distributions. Ubuntu has released patches for version 24.04 LTS (Noble) with kernel version 6.8.0-44.44, and Red Hat has addressed it in their kernel-rt security update. The fix involves preventing DPT objects from being shrinkable by adding a condition to check the is_dpt flag (Ubuntu, Red Hat).