CVE-2024-53148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-53148", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:24.998Z", "datePublished": "2024-12-24T11:28:48.619Z", "dateUpdated": "2026-08-05T11:44:10.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:10.150Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Flush partial mappings in error case\n\nIf some remap_pfn_range() calls succeeded before one failed, we still have\nbuffer pages mapped into the userspace page tables when we drop the buffer\nreference with comedi_buf_map_put(bm). The userspace mappings are only\ncleaned up later in the mmap error path.\n\nFix it by explicitly flushing all mappings in our VMA on the error path.\n\nSee commit 79a61cc3fc04 (\"mm: avoid leaving partial pfn mappings around in\nerror case\")."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only via mmap(2) on a local comedi character device node (/dev/comediN); there is no network or physical-bus interface involved.\nAC:L - The attacker controls both sides of the condition \u2014 inducing the partial remap_pfn_range failure via memory pressure and racing a concurrent buffer free (BUFCONFIG/detach) \u2014 so per the UAF/attacker-controlled-race guidance this is Low.\nPR:L - Once a driver is attached (a common one-time privileged setup), an unprivileged local user with access to the device node can allocate a buffer and mmap it without any capability; the vulnerable comedi_mmap and buffer-resize paths have no CAP check.\nUI:N - The attacker performs the open, buffer allocation, and mmap entirely on their own; no victim action is required.\nS:U - The corruption stays within the kernel's own security authority (kernel-managed memory); no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling userspace PTEs point at physical pages that are freed and reallocated to arbitrary kernel or other-process uses, giving the attacker a read primitive over reused memory.\nI:H - The stale mappings are writable (PAGE_SHARED), so userspace can write into freed/reallocated physical pages \u2014 an arbitrary write primitive suitable for privilege escalation.\nA:H - Dangling PTEs to reused physical pages readily corrupt kernel memory, causing oopses/panics and system instability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/comedi/comedi_fops.c"], "versions": [{"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "57f048c2d205b85e34282a9b0b0ae177e84c2f44", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "b9322408d83accc8b96322bc7356593206288c56", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "8797b7712de704dc231f9e821d8eb3b9aeb3a032", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "16c507df509113c037cdc0ba642b9ab3389bd26c", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "9b07fb464eb69a752406e78e62ab3a60bfa7b00d", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "c6963a06ce5c61d3238751ada04ee1569663a828", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "297f14fbb81895f4ccdb0ad25d196786d6461e00", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "ce8f9fb651fac95dd41f69afe54d935420b945bd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/comedi/comedi_fops.c"], "versions": [{"version": "2.6.29", "status": "affected"}, {"version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.4.287"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.10.231"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.15.174"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.1.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.6.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.11.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/57f048c2d205b85e34282a9b0b0ae177e84c2f44"}, {"url": "https://git.kernel.org/stable/c/b9322408d83accc8b96322bc7356593206288c56"}, {"url": "https://git.kernel.org/stable/c/8797b7712de704dc231f9e821d8eb3b9aeb3a032"}, {"url": "https://git.kernel.org/stable/c/16c507df509113c037cdc0ba642b9ab3389bd26c"}, {"url": "https://git.kernel.org/stable/c/9b07fb464eb69a752406e78e62ab3a60bfa7b00d"}, {"url": "https://git.kernel.org/stable/c/c6963a06ce5c61d3238751ada04ee1569663a828"}, {"url": "https://git.kernel.org/stable/c/297f14fbb81895f4ccdb0ad25d196786d6461e00"}, {"url": "https://git.kernel.org/stable/c/ce8f9fb651fac95dd41f69afe54d935420b945bd"}], "title": "comedi: Flush partial mappings in error case", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:46:32.627Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/comedi/comedi_fops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "57f048c2d205b85e34282a9b0b0ae177e84c2f44", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "b9322408d83accc8b96322bc7356593206288c56", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "8797b7712de704dc231f9e821d8eb3b9aeb3a032", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "16c507df509113c037cdc0ba642b9ab3389bd26c", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "9b07fb464eb69a752406e78e62ab3a60bfa7b00d", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "c6963a06ce5c61d3238751ada04ee1569663a828", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "297f14fbb81895f4ccdb0ad25d196786d6461e00", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "ce8f9fb651fac95dd41f69afe54d935420b945bd", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/comedi/comedi_fops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"lessThan": "2.6.29", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.287", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.231", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.174", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.64", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.11", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1298C84F-E296-4E2D-8B96-829D4E94588D", "versionEndExcluding": "5.4.287", "versionStartIncluding": "2.6.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935", "versionEndExcluding": "5.10.231", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89", "versionEndExcluding": "5.15.174", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265", "versionEndExcluding": "6.1.120", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7", "versionEndExcluding": "6.6.64", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "21434379-192D-472F-9B54-D45E3650E893", "versionEndExcluding": "6.11.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776", "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Flush partial mappings in error case\n\nIf some remap_pfn_range() calls succeeded before one failed, we still have\nbuffer pages mapped into the userspace page tables when we drop the buffer\nreference with comedi_buf_map_put(bm). The userspace mappings are only\ncleaned up later in the mmap error path.\n\nFix it by explicitly flushing all mappings in our VMA on the error path.\n\nSee commit 79a61cc3fc04 (\"mm: avoid leaving partial pfn mappings around in\nerror case\")."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: comedi: vaciar asignaciones parciales en caso de error. Si algunas llamadas a remap_pfn_range() tuvieron \u00e9xito antes de que una fallara, todav\u00eda tenemos p\u00e1ginas de b\u00fafer asignadas a las tablas de p\u00e1ginas del espacio de usuario cuando eliminamos la referencia de b\u00fafer con comedi_buf_map_put (bm). Las asignaciones del espacio de usuario solo se limpian m\u00e1s adelante en la ruta de error mmap. Solucionelo eliminando expl\u00edcitamente todas las asignaciones en nuestro VMA en la ruta del error. Consulte el commit 79a61cc3fc04 (\"mm: evite dejar asignaciones pfn parciales en caso de error\")."}], "id": "CVE-2024-53148", "lastModified": "2026-08-04T11:21:58.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-12-24T12:15:22.887", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16c507df509113c037cdc0ba642b9ab3389bd26c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/297f14fbb81895f4ccdb0ad25d196786d6461e00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57f048c2d205b85e34282a9b0b0ae177e84c2f44"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8797b7712de704dc231f9e821d8eb3b9aeb3a032"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9b07fb464eb69a752406e78e62ab3a60bfa7b00d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9322408d83accc8b96322bc7356593206288c56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c6963a06ce5c61d3238751ada04ee1569663a828"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce8f9fb651fac95dd41f69afe54d935420b945bd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: comedi: Flush partial mappings in error case", "id": "2333970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333970"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncomedi: Flush partial mappings in error case\nIf some remap_pfn_range() calls succeeded before one failed, we still have\nbuffer pages mapped into the userspace page tables when we drop the buffer\nreference with comedi_buf_map_put(bm). The userspace mappings are only\ncleaned up later in the mmap error path.\nFix it by explicitly flushing all mappings in our VMA on the error path.\nSee commit 79a61cc3fc04 (\"mm: avoid leaving partial pfn mappings around in\nerror case\")."], "name": "CVE-2024-53148", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-53148\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-53148\nhttps://lore.kernel.org/linux-cve-announce/2024122426-CVE-2024-53148-2c24@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:22:32.594436+00:00", "updated": "2025-07-13T11:22:32.594490+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}