{"schema_version":"1.9.0","id":"CVE-2024-27066","published":"2024-05-01T13:04:12.582Z","modified":"2026-08-12T03:51:17.813201193Z","summary":"virtio: packed: fix unmap leak for indirect desc table","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n  if (unlikely(vq->do_unmap)) {\n                curr = id;\n                for (i = 0; i < state->num; i++) {\n                        vring_unmap_extra_packed(vq,\n                                                 &vq->packed.desc_extra[curr]);\n                        curr = vq->packed.desc_extra[curr].next;\n                }\n  }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq->use_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b319940f83c21bb4c1fabffe68a862be879a6193"},{"fixed":"e142169aca5546ae6619c39a575cda8105362100"},{"fixed":"75450ff8c6fe8755bf5b139b238eaf9739cfd64e"},{"fixed":"51bacd9d29bf98c3ebc65e4a0477bb86306b4140"},{"fixed":"d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27066.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.23"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.7.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27066.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"},{"type":"WEB","url":"https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27066.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27066"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27066.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}