CVE-2024-56712Low· 3.3▾ Sunlit

udmabuf: fix memory leak on last export_udmabuf() error path

In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix memory leak on last export_udmabuf() error path In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a dma_buf owning the udmabuf has …

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score18/ 100 · Minimal

impact 18.2 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 29, 2024

Updated

Oct 21, 2026

CVSS

3.3

Vendor

Linux

Product

Linux

CWE

—

Depth score

18 · Minimal

EPSS

0.25% · p16

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

decided 2025-04-17

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.2% → 0.3%▲ 0.06%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 666 days

Dec 29, 2024Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.2%
Oct 26, 2026EPSS peak
0.2% → 0.3%

Linux #cve.org

Affected

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < e469922fbdf6ad729e5dc8d49289b5036a0ecdf8
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < c9fc8428d4255c2128da9c4d5cd92e554d0150cf
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < f49856f525acd5bef52ae28b7da2e001bbe7439e
Linux 4.20

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

udmabuf: fix memory leak on last export_udmabuf() error path

In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a dma_buf owning the udmabuf has already been created; but the error handling in udmabuf_create() will tear down the udmabuf without doing anything about the containing dma_buf.

This leaves a dma_buf in memory that contains a dangling pointer; though that doesn't seem to lead to anything bad except a memory leak.

Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we can give it different error handling.

Note that the shape of this code changed a lot in commit 5e72b2b41a21 ("udmabuf: convert udmabuf driver to use folios"); but the memory leak seems to have existed since the introduction of udmabuf.

Affected

Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < e469922fbdf6ad729e5dc8d49289b5036a0ecdf8
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < c9fc8428d4255c2128da9c4d5cd92e554d0150cf
Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < f49856f525acd5bef52ae28b7da2e001bbe7439e
Linux 4.20

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

udmabuf: fix memory leak on last export_udmabuf() error path

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score18/ 100 · Minimal

impact 18.2 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

udmabuf: fix memory leak on last export_udmabuf() error path

This leaves a dma_buf in memory that contains a dangling pointer; though that doesn't seem to lead to anything bad except a memory leak.

Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we can give it different error handling.

Note that the shape of this code changed a lot in commit 5e72b2b41a21 ("udmabuf: convert udmabuf driver to use folios"); but the memory leak seems to have existed since the introduction of udmabuf.