---
id: CVE-2024-35951
title: 'drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()

  Subject: [PATCH] drm/panfrost: Fix the error path in
   panfrost_mmu_map_fault_addr()

  If some the page…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 187d2929206e6b098312c174ea873e4cedf5420d <
    f959d043b745b352c7d1c9b832a57ffcf05bc935
  - >-
    Linux >= 187d2929206e6b098312c174ea873e4cedf5420d <
    31806711e8a4b75e09b1c43652f2a6420e6e1002
  - >-
    Linux >= 187d2929206e6b098312c174ea873e4cedf5420d <
    e18070c622c63f0cab170348e320454728c277aa
  - >-
    Linux >= 187d2929206e6b098312c174ea873e4cedf5420d <
    1fc9af813b25e146d3607669247d0f970f5a87c3
  - Linux 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-05-23T19:20:08.650498Z'
published: '2024-05-20'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:18:25.033Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-35951'
references:
  - url: 'https://git.kernel.org/stable/c/f959d043b745b352c7d1c9b832a57ffcf05bc935'
  - url: 'https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002'
  - url: 'https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa'
  - url: 'https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3'
tags:
  - cve.org
epss: 0.00247
epssPercentile: 0.16067
ingestedAt: '2026-11-03T12:44:28.816Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()

Subject: [PATCH] drm/panfrost: Fix the error path in
 panfrost_mmu_map_fault_addr()

If some the pages or sgt allocation failed, we shouldn't release the
pages ref we got earlier, otherwise we will end up with unbalanced
get/put_pages() calls. We should instead leave everything in place
and let the BO release function deal with extra cleanup when the object
is destroyed, or let the fault handler try again next time it's called.

## Affected

- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < f959d043b745b352c7d1c9b832a57ffcf05bc935`
- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < 31806711e8a4b75e09b1c43652f2a6420e6e1002`
- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < e18070c622c63f0cab170348e320454728c277aa`
- `Linux >= 187d2929206e6b098312c174ea873e4cedf5420d < 1fc9af813b25e146d3607669247d0f970f5a87c3`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.