CVE-2024-56544Medium· 5.5▾ Sunlit

udmabuf: change folios array from kmalloc to kvmalloc

In the Linux kernel, the following vulnerability has been resolved: udmabuf: change folios array from kmalloc to kvmalloc When PAGE_SIZE 4096, MAX_PAGE_ORDER 10, 64bit machine, page_alloc only support 4MB. If above this, trigger this w…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 30.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 27, 2024

Updated

Oct 21, 2026

CVSS

5.5

Vendor

Linux

Product

Linux

CWE

—

Depth score

30 · Low

EPSS

0.25% · p17

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2025-10-01

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.2% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 668 days

Dec 27, 2024Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.2%
Oct 26, 2026EPSS peak
0.2% → 0.3%

Linux #cve.org

Affected

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 2384a29db79bd2cfe0b7646ac0030cb355825e29
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 2acc6192aa8570661ed37868c02c03002b1dc290
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 85bb72397cb63649fe493c96e27e1d0e4ed2ff63
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 1c0844c6184e658064e14c4335885785ad3bf84b
Linux 4.20

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

udmabuf: change folios array from kmalloc to kvmalloc

When PAGE_SIZE 4096, MAX_PAGE_ORDER 10, 64bit machine, page_alloc only support 4MB. If above this, trigger this warn and return NULL.

udmabuf can change size limit, if change it to 3072(3GB), and then alloc 3GB udmabuf, will fail create.

[ 4080.876581] ------------[ cut here ]------------ [ 4080.876843] WARNING: CPU: 3 PID: 2015 at mm/page_alloc.c:4556 __alloc_pages+0x2c8/0x350 [ 4080.878839] RIP: 0010:__alloc_pages+0x2c8/0x350 [ 4080.879470] Call Trace: [ 4080.879473] <TASK> [ 4080.879473] ? __alloc_pages+0x2c8/0x350 [ 4080.879475] ? __warn.cold+0x8e/0xe8 [ 4080.880647] ? __alloc_pages+0x2c8/0x350 [ 4080.880909] ? report_bug+0xff/0x140 [ 4080.881175] ? handle_bug+0x3c/0x80 [ 4080.881556] ? exc_invalid_op+0x17/0x70 [ 4080.881559] ? asm_exc_invalid_op+0x1a/0x20 [ 4080.882077] ? udmabuf_create+0x131/0x400

Because MAX_PAGE_ORDER, kmalloc can max alloc 4096 * (1 << 10), 4MB memory, each array entry is pointer(8byte), so can save 524288 pages(2GB).

Further more, costly order(order 3) may not be guaranteed that it can be applied for, due to fragmentation.

This patch change udmabuf array use kvmalloc_array, this can fallback alloc into vmalloc, which can guarantee allocation for any size and does not affect the performance of kmalloc allocations.

Affected

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 2384a29db79bd2cfe0b7646ac0030cb355825e29
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 2acc6192aa8570661ed37868c02c03002b1dc290
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 85bb72397cb63649fe493c96e27e1d0e4ed2ff63
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 1c0844c6184e658064e14c4335885785ad3bf84b
Linux 4.20

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

udmabuf: change folios array from kmalloc to kvmalloc

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 30.3 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

udmabuf: change folios array from kmalloc to kvmalloc

When PAGE_SIZE 4096, MAX_PAGE_ORDER 10, 64bit machine, page_alloc only support 4MB. If above this, trigger this warn and return NULL.

udmabuf can change size limit, if change it to 3072(3GB), and then alloc 3GB udmabuf, will fail create.

Because MAX_PAGE_ORDER, kmalloc can max alloc 4096 * (1 << 10), 4MB memory, each array entry is pointer(8byte), so can save 524288 pages(2GB).

Further more, costly order(order 3) may not be guaranteed that it can be applied for, due to fragmentation.

This patch change udmabuf array use kvmalloc_array, this can fallback alloc into vmalloc, which can guarantee allocation for any size and does not affect the performance of kmalloc allocations.

Affected

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 2384a29db79bd2cfe0b7646ac0030cb355825e29

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 2acc6192aa8570661ed37868c02c03002b1dc290

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 85bb72397cb63649fe493c96e27e1d0e4ed2ff63

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 1c0844c6184e658064e14c4335885785ad3bf84b

Linux 4.20