CVE-2024-27029
drm/amdgpu: fix mmhub client id out-of-bounds access
HIGH
7.1
CVSS Score
Published: May 1, 2024 at 12:53 PM UTC
Updated: August 5, 2026 at 12:04 PM UTC
1 product affected across 1 vendorLinux Kernel
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mmhub client id out-of-bounds access Properly handle cid 0x140.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
6.7 ≤ v < 6.7.116.7 ≤ v < 6.8.26.7 ≤ v < 6.96.8 ≤ v < 6.8.26.7aba2be41470a11629c8378c3651323d7e5416df6
Vendor states this is fixed in 1f24b3040f2b6ffcb97151fabb3070328254d923 (fixed)
Vendor states this is fixed in 6540ff6482c1a5a6890ae44b23d0852ba1986d9e (fixed)
Vendor states this is fixed in e1e076bda4fd6378ae650f2c6ef1a4ff93c5aea5 (fixed)
Vendor states this is fixed in 6.7 (unaffected)
Vendor states this is fixed in 6.7.11 (unaffected)
Vendor states this is fixed in 6.8.2 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (3)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1f24b3040f2b6ffcb97151fabb3070328254d923Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6540ff6482c1a5a6890ae44b23d0852ba1986d9ePatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e1e076bda4fd6378ae650f2c6ef1a4ff93c5aea5SSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
7.1HIGHLinux
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-125
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card