{"id":"CVE-2024-43856","revision":"a539fa00b332482c8bb59aeb09b82d18","records":[{"revision":"a539fa00b332482c8bb59aeb09b82d18","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-43856","aliases":[],"title":"dma: fix call order in dmam_free_coherent","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n  kokonut //net/encryption\n    http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03","state":0,"publishedAt":"2024-08-17T09:24:26.56+00:00","modifiedAt":"2026-10-15T00:48:27.417+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/dma/mapping.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"fe2d246080f035e0af5793cb79067ba125e4fb63\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"2f7bbdc744f2e7051d1cb47c8e082162df1923c9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"257193083e8f43907e99ea633820fc2b3bcd24c7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"87b34c8c94e29fa01d744e5147697f592998d954\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"f993a4baf6b622232e4c190d34c220179e5d61eb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"1fe97f68fce1ba24bf823bfb0eb0956003473130\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"22094f5f52e7bc16c5bf9613365049383650b02e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9ac7849e35f705830f7b016ff272b0ff1f7ff759\",\n                            \"lessThan\": \"28e8b7406d3a1f5329a03aa25a43aa28e087cb20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/dma/mapping.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.21\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.21\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.320\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.282\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.224\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.165\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.103\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.44\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.10.3\",\n                            \"lessThanOrEqual\": \"6.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/fe2d246080f035e0af5793cb79067ba125e4fb63","https://git.kernel.org/stable/c/2f7bbdc744f2e7051d1cb47c8e082162df1923c9","https://git.kernel.org/stable/c/257193083e8f43907e99ea633820fc2b3bcd24c7","https://git.kernel.org/stable/c/87b34c8c94e29fa01d744e5147697f592998d954","https://git.kernel.org/stable/c/f993a4baf6b622232e4c190d34c220179e5d61eb","https://git.kernel.org/stable/c/1fe97f68fce1ba24bf823bfb0eb0956003473130","https://git.kernel.org/stable/c/22094f5f52e7bc16c5bf9613365049383650b02e","https://git.kernel.org/stable/c/28e8b7406d3a1f5329a03aa25a43aa28e087cb20"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-43856","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-43856","identifiers":["CVE-2024-43856"]},"retained":false,"historicalAffected":[]}],"coverage":[]}