CVE-2024-38549drm/mediatek: Add 0 size check to mtk_drm_gem_obj
- 5.5MediumCVSS base score
- 0.28%Exploitation in 30 daysEPSS · top 79% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtk_drm_gem_obj Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object of 0 bytes. Currently, no such check exists and the kernel will panic if a userspace application attempts to allocate a 0x0 GBM buffer. Tested by attempting to allocate a 0x0 GBM buffer on an MT8188 and verifying that we now return EINVAL.
Timeline
ID reserved
By Linux
- 1 day later
· 1 day later
Published
- 23 months later
· 23 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.28% · top 79% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < 79078880795478d551a05acc41f957700030d364
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < be34a1b351ea7faeb15dde8c44fe89de3980ae67
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < d17b75ee9c2e44d3a3682c4ea5ab713ea6073350
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < 0e3b6f9123726858cac299e1654e3d20424cabe4
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < 13562c2d48c9ee330de1077d00146742be368f05
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < af26ea99019caee1500bf7e60c861136c0bf8594
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < 9489951e3ae505534c4013db4e76b1b5a3151ac7
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < fb4aabdb1b48c25d9e1ee28f89440fd2ce556405
- affected 119f5173628aa7a0c3cf9db83460d40709e8241d – < 1e4350095e8ab2577ee05f8c3b044e661b5af9a0
- affected 4.7
- unaffected < 4.7
- unaffected 4.19.316 – ≤ 4.19.*
- unaffected 5.4.278 – ≤ 5.4.*
- unaffected 5.10.219 – ≤ 5.10.*
- unaffected 5.15.161 – ≤ 5.15.*
- unaffected 6.1.93 – ≤ 6.1.*
- unaffected 6.6.33 – ≤ 6.6.*
- unaffected 6.8.12 – ≤ 6.8.*
- unaffected 6.9.3 – ≤ 6.9.*
- unaffected 6.10 – ≤ *
References
References10
- https://git.kernel.org/stable/c/79078880795478d551a05acc41f957700030d364 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/be34a1b351ea7faeb15dde8c44fe89de3980ae67 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/d17b75ee9c2e44d3a3682c4ea5ab713ea6073350 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/0e3b6f9123726858cac299e1654e3d20424cabe4 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/13562c2d48c9ee330de1077d00146742be368f05 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/af26ea99019caee1500bf7e60c861136c0bf8594 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/9489951e3ae505534c4013db4e76b1b5a3151ac7 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/fb4aabdb1b48c25d9e1ee28f89440fd2ce556405 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/1e4350095e8ab2577ee05f8c3b044e661b5af9a0 (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-37412 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-38549)Record last updated .