CVE-2024-44948

x86/mtrr: Check if fixed MTRRs exist before saving them

MEDIUM
5.5
CVSS Score
Published: September 4, 2024 at 06:35 PM UTC
Updated: October 15, 2026 at 01:18 AM UTC
2 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFP

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.22 ≤ v < 4.19.3204.20 ≤ v < 5.4.2825.11 ≤ v < 5.15.1655.16 ≤ v < 6.1.1055.5 ≤ v < 5.10.2246.2 ≤ v < 6.6.466.7 ≤ v < 6.10.52.6.222b1f6278d77c1f2f669346fc2bb48012b5e9495a6.116.11 rc16.11 rc2
Vendor states this is fixed in 06c1de44d378ec5439db17bf476507d68589bfe9 (fixed)
Vendor states this is fixed in 34f36e6ee5bd7eff8b2adcd9fcaef369f752d82e (fixed)
Vendor states this is fixed in 388f1c954019f253a8383f7eb733f38d541e10b6 (fixed)
Vendor states this is fixed in 450b6b22acdaac67a18eaf5ed498421ffcf10051 (fixed)
Vendor states this is fixed in 8a90d3fc7c24608548d3a750671f9dac21d1a462 (fixed)
Vendor states this is fixed in 8aa79dfb216b865e96ff890bc4ea71650f9bc8d7 (fixed)
Vendor states this is fixed in 919f18f961c03d6694aa726c514184f2311a4614 (fixed)
Vendor states this is fixed in ca7d00c5656d1791e28369919e3e10febe9c3b16 (fixed)
Vendor states this is fixed in 2.6.22 (unaffected)
Vendor states this is fixed in 4.19.320 (unaffected)
Vendor states this is fixed in 5.10.224 (unaffected)
Vendor states this is fixed in 5.15.165 (unaffected)
Vendor states this is fixed in 5.4.282 (unaffected)
Vendor states this is fixed in 6.1.105 (unaffected)
Vendor states this is fixed in 6.10.5 (unaffected)
Vendor states this is fixed in 6.11 (unaffected)
Vendor states this is fixed in 6.6.46 (unaffected)

References (11)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/06c1de44d378ec5439db17bf476507d68589bfe9
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/34f36e6ee5bd7eff8b2adcd9fcaef369f752d82e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/388f1c954019f253a8383f7eb733f38d541e10b6
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/450b6b22acdaac67a18eaf5ed498421ffcf10051
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8a90d3fc7c24608548d3a750671f9dac21d1a462
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8aa79dfb216b865e96ff890bc4ea71650f9bc8d7
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/919f18f961c03d6694aa726c514184f2311a4614
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ca7d00c5656d1791e28369919e3e10febe9c3b16

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card