# CVE-2024-49894: Linux Kernel AMD Display Driver out-of-bounds access in degamma translation

Source: https://junglewise.ai/threats/cve-2024-49894-linux-kernel-amd-display-driver-out-of-bounds-access-in-degamma  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-21. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-49894 · Severity: high · CVSS 7.8 · Published 2024-10-21

A vulnerability exists in the Linux kernel's AMD display driver, which manages how graphics are rendered on systems with AMD hardware. An attacker with local access to the system could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information. This issue affects the stability and security of workstations and servers using affected AMD graphics components.

## Quick answers

**Is CVE-2024-49894 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-49894 being exploited in the wild.

**How severe is CVE-2024-49894?** High severity, with a CVSS score of 7.8, published 21 October 2024.

**Which products and versions are affected?** Linux Foundation Linux kernel up to (excluding) 5.10.227, 5.11 to (excluding) 5.15.168, 5.16 to (excluding) 6.1.113, 6.2 to (excluding) 6.6.55, 6.7 to (excluding) 6.10.14, 6.11 to (excluding) 6.11.3.

**Is there a fix for CVE-2024-49894?** A patch was published on 2024-10-10: Patches committed to stable branches 6.1, 6.6, 6.10, etc. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-49894 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2024-49894?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read/write vulnerability exists in the 'cm_helper_translate_curve_to_degamma_hw_format' function within the AMD display driver (amdgpu) of the Linux kernel. The root cause is a lack of bounds checking on the index 'i' when accessing transfer function points (TRANSFER_FUNC_POINTS) for red, green, and blue color channels. A local attacker can trigger this by providing a specially crafted transfer function, leading to a buffer overflow. This can result in a kernel panic (DoS) or arbitrary code execution in kernel space. The issue has been patched in various stable branches by adding explicit bounds validation for the index before array access.

## Affected products

- Linux Foundation Linux kernel up to (excluding) 5.10.227, 5.11 to (excluding) 5.15.168, 5.16 to (excluding) 6.1.113, 6.2 to (excluding) 6.6.55, 6.7 to (excluding) 6.10.14, 6.11 to (excluding) 6.11.3

## Timeline

- 2024-10-21: disclosed: Initial disclosure by kernel.org
- 2024-10-21: advisory: NVD publication date
- 2024-10-10: patched: Patches committed to stable branches 6.1, 6.6, 6.10, etc.

## References

- [https://git.kernel.org/stable/c/07078fa5d589a7fbce8f81ea8acf7aa0021ab38e](https://git.kernel.org/stable/c/07078fa5d589a7fbce8f81ea8acf7aa0021ab38e)
- [https://git.kernel.org/stable/c/122e3a7a8c7bcbe3aacddd6103f67f9f36bed473](https://git.kernel.org/stable/c/122e3a7a8c7bcbe3aacddd6103f67f9f36bed473)
- [https://git.kernel.org/stable/c/2495c8e272d84685403506833a664fad932e453a](https://git.kernel.org/stable/c/2495c8e272d84685403506833a664fad932e453a)
- [https://git.kernel.org/stable/c/2f5da549535be8ccd2ab7c9abac8562ad370b181](https://git.kernel.org/stable/c/2f5da549535be8ccd2ab7c9abac8562ad370b181)
- [https://git.kernel.org/stable/c/b3dfa878257a7e98830b3009ca5831a01d8f85fc](https://git.kernel.org/stable/c/b3dfa878257a7e98830b3009ca5831a01d8f85fc)
- [https://git.kernel.org/stable/c/b7e99058eb2e86aabd7a10761e76cae33d22b49f](https://git.kernel.org/stable/c/b7e99058eb2e86aabd7a10761e76cae33d22b49f)
- [https://git.kernel.org/stable/c/c130a3c09e3746c1a09ce26c20d21d449d039b1d](https://git.kernel.org/stable/c/c130a3c09e3746c1a09ce26c20d21d449d039b1d)