UnratedFix available
drm/nouveau: prime: fix refcount underflow
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. (cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.224, 5.15.165, 5.4.282, 6.1.104, 6.10.4, 6.6.45
- CVEs
- CVE-2024-43867
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 21:43 UTC · Revision 1
Source evidence
drm/nouveau: prime: fix refcount underflow
core-osv · Original sourcePublished 20 Aug 2024, 23:50 UTC
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. (cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)
osv:CVE-2024-43867
Kernel
Fixed versions: 5.4.282, 5.10.224, 5.15.165, 6.1.104, 6.6.45, 6.10.4
Complete source record
{
"id": "a3bda824763562d7d12102f6ebd3c4ac26005d0447505e608428fc61a8112003",
"url": "https://osv.dev/vulnerability/CVE-2024-43867",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "drm/nouveau: prime: fix refcount underflow",
"summary": "In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. (cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)",
"evidence": "osv:CVE-2024-43867",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.282",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.224",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.165",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.104",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.45",
"evidence": "/affected/1/ranges"
},
{
"value": "6.10.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2024-43867",
"aliases": [
"CVE-2024-43867"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ab9ccb96a6e6f95bcde6b8b2a524370efdbfdcd6"
},
{
"fixed": "3bcb8bba72ce89667fa863054956267c450c47ef"
},
{
"fixed": "906372e753c5027a1dc88743843b6aa2ad1aaecf"
},
{
"fixed": "16998763c62bb465ebc409d0373b9cdcef1a61a6"
},
{
"fixed": "ebebba4d357b6c67f96776a48ddbaf0060fa4c10"
},
{
"fixed": "f23cd66933fe76b84d8e282e5606b4d99068c320"
},
{
"fixed": "2a1b327d57a8ac080977633a18999f032d7e9e3f"
},
{
"fixed": "a9bf3efc33f1fbf88787a277f7349459283c9b95"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43867.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.9.0"
},
{
"fixed": "5.4.282"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.224"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.165"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.104"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.45"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.10.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43867.json"
}
}
],
"modified": "2026-10-28T02:30:40.219158029Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/16998763c62bb465ebc409d0373b9cdcef1a61a6",
"https://git.kernel.org/stable/c/2a1b327d57a8ac080977633a18999f032d7e9e3f",
"https://git.kernel.org/stable/c/3bcb8bba72ce89667fa863054956267c450c47ef",
"https://git.kernel.org/stable/c/906372e753c5027a1dc88743843b6aa2ad1aaecf",
"https://git.kernel.org/stable/c/a9bf3efc33f1fbf88787a277f7349459283c9b95",
"https://git.kernel.org/stable/c/ebebba4d357b6c67f96776a48ddbaf0060fa4c10",
"https://git.kernel.org/stable/c/f23cd66933fe76b84d8e282e5606b4d99068c320",
"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html",
"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43867.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-43867",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43867.json"
}
},
"related_cves": [
{
"value": "CVE-2024-43867",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 507371,
"published_at": "2024-08-20T23:50:50.429+00:00"
}