{"id":"CVE-2024-35951","title":"drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\n\nSubject: [PATCH] drm/panfrost: Fix the error path in\n panfrost_mmu_map_fault_addr()\n\nIf some the page…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < f959d043b745b352c7d1c9b832a57ffcf05bc935","Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < 31806711e8a4b75e09b1c43652f2a6420e6e1002","Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < e18070c622c63f0cab170348e320454728c277aa","Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < 1fc9af813b25e146d3607669247d0f970f5a87c3","Linux 5.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-05-23T19:20:08.650498Z"},"published":"2024-05-20","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:18:25.033Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-35951","references":[{"url":"https://git.kernel.org/stable/c/f959d043b745b352c7d1c9b832a57ffcf05bc935"},{"url":"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002"},{"url":"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa"},{"url":"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3"}],"tags":["cve.org"],"epss":0.00247,"epssPercentile":0.16067,"ingestedAt":"2026-11-03T12:44:28.816Z","slug":"CVE-2024-35951","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\n\nSubject: [PATCH] drm/panfrost: Fix the error path in\n panfrost_mmu_map_fault_addr()\n\nIf some the pages or sgt allocation failed, we shouldn't release the\npages ref we got earlier, otherwise we will end up with unbalanced\nget/put_pages() calls. We should instead leave everything in place\nand let the BO release function deal with extra cleanup when the object\nis destroyed, or let the fault handler try again next time it's called.\n\n## Affected\n\n- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < f959d043b745b352c7d1c9b832a57ffcf05bc935`\n- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < 31806711e8a4b75e09b1c43652f2a6420e6e1002`\n- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < e18070c622c63f0cab170348e320454728c277aa`\n- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < 1fc9af813b25e146d3607669247d0f970f5a87c3`\n- `Linux 5.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}