CVE-2024-46716 (GCVE-0-2024-46716)

Vulnerability from cvelistv5 – Published: 2024-09-18 06:32 – Updated: 2026-08-05 11:38
VLAI
Title
dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor Remove list_del call in msgdma_chan_desc_cleanup, this should be the role of msgdma_free_descriptor. In consequence replace list_add_tail with list_move_tail in msgdma_free_descriptor. This fixes the path: msgdma_free_chan_resources -> msgdma_free_descriptors -> msgdma_free_desc_list -> msgdma_free_descriptor which does not correctly free the descriptors as first nodes were not removed from the list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 14:58 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a85c6f1b2921cbd2f54666a52804f407c4a064fe , < a3480e59fdbe5585d2d1eff0bed7671583acf725 (git)
Affected: a85c6f1b2921cbd2f54666a52804f407c4a064fe , < 20bf2920a869f9dbda0ef8c94c87d1901a64a716 (git)
Affected: a85c6f1b2921cbd2f54666a52804f407c4a064fe , < db67686676c7becc1910bf1d6d51505876821863 (git)
Affected: a85c6f1b2921cbd2f54666a52804f407c4a064fe , < 54e4ada1a4206f878e345ae01cf37347d803d1b1 (git)
Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 6.1.109 , ≤ 6.1.* (semver)
Unaffected: 6.6.50 , ≤ 6.6.* (semver)
Unaffected: 6.10.9 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46716",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:58:09.271369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:58:23.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:48.183Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/altera-msgdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3480e59fdbe5585d2d1eff0bed7671583acf725",
              "status": "affected",
              "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
              "versionType": "git"
            },
            {
              "lessThan": "20bf2920a869f9dbda0ef8c94c87d1901a64a716",
              "status": "affected",
              "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
              "versionType": "git"
            },
            {
              "lessThan": "db67686676c7becc1910bf1d6d51505876821863",
              "status": "affected",
              "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
              "versionType": "git"
            },
            {
              "lessThan": "54e4ada1a4206f878e345ae01cf37347d803d1b1",
              "status": "affected",
              "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/altera-msgdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.109",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.50",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.9",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor\n\nRemove list_del call in msgdma_chan_desc_cleanup, this should be the role\nof msgdma_free_descriptor. In consequence replace list_add_tail with\nlist_move_tail in msgdma_free_descriptor.\n\nThis fixes the path:\n   msgdma_free_chan_resources -\u003e msgdma_free_descriptors -\u003e\n   msgdma_free_desc_list -\u003e msgdma_free_descriptor\n\nwhich does not correctly free the descriptors as first nodes were not\nremoved from the list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The Altera/Intel mSGDMA is a memory-mapped platform DMA controller on SoC-FPGA systems; the vulnerable free/alloc path is reached only through local dmaengine client activity (device-node open/close driving dma_chan_get/dma_chan_put), never from remote or adjacent-network input.\nAC:L - No race or uncontrollable precondition is involved \u2014 submitting a descriptor and then releasing the channel deterministically leaves pending_list non-empty at msgdma_free_descriptors() time, guaranteeing the list corruption and the dangling list heads that survive into the next channel allocation.\nPR:L - An unprivileged local user with access to the FPGA-fabric peripheral\u0027s device node (routinely group-accessible on industrial/embedded SoC-FPGA deployments) can drive the submit/release/re-acquire cycle that triggers the bug; no root or CAP_SYS_ADMIN gate exists on the dmaengine descriptor path.\nUI:N - The attacker performs the entire sequence itself \u2014 open, prep/submit, close, reopen, submit \u2014 with no victim action, file to open, or filesystem to mount required.\nS:U - The corruption and its consequences remain within the kernel\u0027s own security authority; the DMA programming is issued by the kernel on its own behalf and no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling descriptor pointers are read back after kfree(mdev-\u003esw_desq), and msgdma_copy_one() feeds their hw_desc source/destination addresses straight to the hardware DMA engine, allowing arbitrary physical memory to be read out to the FPGA peripheral in addition to the general UAF read of reallocated kernel objects.\nI:H - The stale list heads give a UAF write primitive (list_add_tail through pending_list.prev), an OOB write into struct msgdma_device via the unchecked list_first_entry() in msgdma_get_descriptor(), and an indirect call through a callback function pointer loaded from freed memory in msgdma_chan_desc_cleanup() \u2014 all usable for control-flow hijacking.\nA:H - Traversing the cross-linked pending/active/done lists into freed memory reliably produces list-corruption oopses, and the hardware DMA engine is programmed from garbage descriptors, crashing or hanging the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:07.411Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3480e59fdbe5585d2d1eff0bed7671583acf725"
        },
        {
          "url": "https://git.kernel.org/stable/c/20bf2920a869f9dbda0ef8c94c87d1901a64a716"
        },
        {
          "url": "https://git.kernel.org/stable/c/db67686676c7becc1910bf1d6d51505876821863"
        },
        {
          "url": "https://git.kernel.org/stable/c/54e4ada1a4206f878e345ae01cf37347d803d1b1"
        }
      ],
      "title": "dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46716",
    "datePublished": "2024-09-18T06:32:16.084Z",
    "dateReserved": "2024-09-11T15:12:18.254Z",
    "dateUpdated": "2026-08-05T11:38:07.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46716",
      "date": "2026-10-03",
      "epss": "0.00227",
      "percentile": "0.12257"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/altera-msgdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a3480e59fdbe5585d2d1eff0bed7671583acf725",
                    "status": "affected",
                    "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "20bf2920a869f9dbda0ef8c94c87d1901a64a716",
                    "status": "affected",
                    "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db67686676c7becc1910bf1d6d51505876821863",
                    "status": "affected",
                    "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "54e4ada1a4206f878e345ae01cf37347d803d1b1",
                    "status": "affected",
                    "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/altera-msgdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.14"
                  },
                  {
                    "lessThan": "4.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EFD3BACD-EA1D-4437-A135-A3E7A761F54F",
                    "versionEndExcluding": "6.1.109",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A56A0460-B122-44D6-B0E6-26CE9C891536",
                    "versionEndExcluding": "6.6.50",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4469C96-A86B-4CC3-B2D5-C21B6B72641B",
                    "versionEndExcluding": "6.10.9",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor\n\nRemove list_del call in msgdma_chan_desc_cleanup, this should be the role\nof msgdma_free_descriptor. In consequence replace list_add_tail with\nlist_move_tail in msgdma_free_descriptor.\n\nThis fixes the path:\n   msgdma_free_chan_resources -\u003e msgdma_free_descriptors -\u003e\n   msgdma_free_desc_list -\u003e msgdma_free_descriptor\n\nwhich does not correctly free the descriptors as first nodes were not\nremoved from the list."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: altera-msgdma: liberar correctamente el descriptor en msgdma_free_descriptor Eliminar la llamada list_del en msgdma_chan_desc_cleanup, esta deber\u00eda ser la funci\u00f3n de msgdma_free_descriptor. En consecuencia, reemplace list_add_tail con list_move_tail en msgdma_free_descriptor. Esto corrige la ruta: msgdma_free_chan_resources -\u0026gt; msgdma_free_descriptors -\u0026gt; msgdma_free_desc_list -\u0026gt; msgdma_free_descriptor que no libera correctamente los descriptores ya que los primeros nodos no se eliminaron de la lista."
          }
        ],
        "id": "CVE-2024-46716",
        "lastModified": "2026-08-04T11:20:17.953",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-46716",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:58:09.271369Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-18T07:15:03.183",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/20bf2920a869f9dbda0ef8c94c87d1901a64a716"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/54e4ada1a4206f878e345ae01cf37347d803d1b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a3480e59fdbe5585d2d1eff0bed7671583acf725"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/db67686676c7becc1910bf1d6d51505876821863"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T09:01:15+00:00",
      "cve": "CVE-2024-46716",
      "id": "CVE-2024-46716",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46716.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:16:48.183Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-46716",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-29T14:58:09.271369Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-29T14:58:13.325Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/dma/altera-msgdma.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "a3480e59fdbe5585d2d1eff0bed7671583acf725",
                  "status": "affected",
                  "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                  "versionType": "git"
                },
                {
                  "lessThan": "20bf2920a869f9dbda0ef8c94c87d1901a64a716",
                  "status": "affected",
                  "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                  "versionType": "git"
                },
                {
                  "lessThan": "db67686676c7becc1910bf1d6d51505876821863",
                  "status": "affected",
                  "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                  "versionType": "git"
                },
                {
                  "lessThan": "54e4ada1a4206f878e345ae01cf37347d803d1b1",
                  "status": "affected",
                  "version": "a85c6f1b2921cbd2f54666a52804f407c4a064fe",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/dma/altera-msgdma.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.14"
                },
                {
                  "lessThan": "4.14",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.109",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.50",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.109",
                      "versionStartIncluding": "4.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.50",
                      "versionStartIncluding": "4.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.9",
                      "versionStartIncluding": "4.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "4.14",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor\n\nRemove list_del call in msgdma_chan_desc_cleanup, this should be the role\nof msgdma_free_descriptor. In consequence replace list_add_tail with\nlist_move_tail in msgdma_free_descriptor.\n\nThis fixes the path:\n   msgdma_free_chan_resources -\u003e msgdma_free_descriptors -\u003e\n   msgdma_free_desc_list -\u003e msgdma_free_descriptor\n\nwhich does not correctly free the descriptors as first nodes were not\nremoved from the list."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The Altera/Intel mSGDMA is a memory-mapped platform DMA controller on SoC-FPGA systems; the vulnerable free/alloc path is reached only through local dmaengine client activity (device-node open/close driving dma_chan_get/dma_chan_put), never from remote or adjacent-network input.\nAC:L - No race or uncontrollable precondition is involved \u2014 submitting a descriptor and then releasing the channel deterministically leaves pending_list non-empty at msgdma_free_descriptors() time, guaranteeing the list corruption and the dangling list heads that survive into the next channel allocation.\nPR:L - An unprivileged local user with access to the FPGA-fabric peripheral\u0027s device node (routinely group-accessible on industrial/embedded SoC-FPGA deployments) can drive the submit/release/re-acquire cycle that triggers the bug; no root or CAP_SYS_ADMIN gate exists on the dmaengine descriptor path.\nUI:N - The attacker performs the entire sequence itself \u2014 open, prep/submit, close, reopen, submit \u2014 with no victim action, file to open, or filesystem to mount required.\nS:U - The corruption and its consequences remain within the kernel\u0027s own security authority; the DMA programming is issued by the kernel on its own behalf and no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling descriptor pointers are read back after kfree(mdev-\u003esw_desq), and msgdma_copy_one() feeds their hw_desc source/destination addresses straight to the hardware DMA engine, allowing arbitrary physical memory to be read out to the FPGA peripheral in addition to the general UAF read of reallocated kernel objects.\nI:H - The stale list heads give a UAF write primitive (list_add_tail through pending_list.prev), an OOB write into struct msgdma_device via the unchecked list_first_entry() in msgdma_get_descriptor(), and an indirect call through a callback function pointer loaded from freed memory in msgdma_chan_desc_cleanup() \u2014 all usable for control-flow hijacking.\nA:H - Traversing the cross-linked pending/active/done lists into freed memory reliably produces list-corruption oopses, and the hardware DMA engine is programmed from garbage descriptors, crashing or hanging the system."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:38:07.411Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/a3480e59fdbe5585d2d1eff0bed7671583acf725"
            },
            {
              "url": "https://git.kernel.org/stable/c/20bf2920a869f9dbda0ef8c94c87d1901a64a716"
            },
            {
              "url": "https://git.kernel.org/stable/c/db67686676c7becc1910bf1d6d51505876821863"
            },
            {
              "url": "https://git.kernel.org/stable/c/54e4ada1a4206f878e345ae01cf37347d803d1b1"
            }
          ],
          "title": "dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-46716",
        "datePublished": "2024-09-18T06:32:16.084Z",
        "dateReserved": "2024-09-11T15:12:18.254Z",
        "dateUpdated": "2026-08-05T11:38:07.411Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.