{"id":"DEBIAN-CVE-2024-39486","details":"In the Linux kernel, the following vulnerability has been resolved:  drm/drm_file: Fix pid refcounting race  \u003cmaarten.lankhorst@linux.intel.com\u003e, Maxime Ripard \u003cmripard@kernel.org\u003e, Thomas Zimmermann \u003ctzimmermann@suse.de\u003e  filp-\u003epid is supposed to be a refcounted pointer; however, before this patch, drm_file_update_pid() only increments the refcount of a struct pid after storing a pointer to it in filp-\u003epid and dropping the dev-\u003efilelist_mutex, making the following race possible:  process A               process B =========               =========                         begin drm_file_update_pid                         mutex_lock(&dev-\u003efilelist_mutex)                         rcu_replace_pointer(filp-\u003epid, \u003cpid B\u003e, 1)                         mutex_unlock(&dev-\u003efilelist_mutex) begin drm_file_update_pid mutex_lock(&dev-\u003efilelist_mutex) rcu_replace_pointer(filp-\u003epid, \u003cpid A\u003e, 1) mutex_unlock(&dev-\u003efilelist_mutex) get_pid(\u003cpid A\u003e) synchronize_rcu() put_pid(\u003cpid B\u003e)   *** pid B reaches refcount 0 and is freed here ***                         get_pid(\u003cpid B\u003e)   *** UAF ***                         synchronize_rcu()                         put_pid(\u003cpid A\u003e)  As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y because it requires RCU to detect a quiescent state in code that is not explicitly calling into the scheduler.  This race leads to use-after-free of a \"struct pid\". It is probably somewhat hard to hit because process A has to pass through a synchronize_rcu() operation while process B is between mutex_unlock() and get_pid().  Fix it by ensuring that by the time a pointer to the current task's pid is stored in the file, an extra reference to the pid has been taken.  This fix also removes the condition for synchronize_rcu(); I think that optimization is unnecessary complexity, since in that case we would usually have bailed out on the lockless check above.","modified":"2026-09-15T09:02:43.351827141Z","published":"2024-07-06T10:15:03.393Z","upstream":["CVE-2024-39486"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-39486"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-39486.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-39486.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}