{"id":"CVE-2024-27066","summary":"virtio: packed: fix unmap leak for indirect desc table","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n  if (unlikely(vq-\u003edo_unmap)) {\n                curr = id;\n                for (i = 0; i \u003c state-\u003enum; i++) {\n                        vring_unmap_extra_packed(vq,\n                                                 &vq-\u003epacked.desc_extra[curr]);\n                        curr = vq-\u003epacked.desc_extra[curr].next;\n                }\n  }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq-\u003euse_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect.","modified":"2026-03-20T12:35:22.953520Z","published":"2024-05-01T13:04:12.582Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27066.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"},{"type":"WEB","url":"https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27066.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27066"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b319940f83c21bb4c1fabffe68a862be879a6193"},{"fixed":"e142169aca5546ae6619c39a575cda8105362100"},{"fixed":"75450ff8c6fe8755bf5b139b238eaf9739cfd64e"},{"fixed":"51bacd9d29bf98c3ebc65e4a0477bb86306b4140"},{"fixed":"d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27066.json"}}],"schema_version":"1.7.5"}