LiveActive security incident?Get immediate response
CVE Record

CVE-2024-46698: video/aperture: optionally match the device in sysfb_disable()

In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfb_disable() In aperture_remove_conflicting_pci_devices(), we currently only call sysfb_disable() on vga class devices. This leads to the following problem when the pimary device is not VGA compatible: 1. A PCI device with a non-VGA class is the boot display 2. That device is probed first and it is not a VGA device so sysfb_disable() is not called, but the device resources are freed by aperture_detach_platform_device() 3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable() 4. NULL pointer dereference via sysfb_disable() since the resources have already been freed by aperture_detach_platform_device() when it was called by the other device. Fix this by passing a device pointer to sysfb_disable() and checking the device to determine if we should execute it or not. v2: Fix build when CONFIG_SCREEN_INFO is not set v3: Move device check into the mutex Drop primary variable in aperture_remove_conflicting_pci_devices() Drop __init on pci sysfb_pci_dev_is_enabled()

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-46698 is a Linux kernel graphics boot-handling flaw. On systems where the boot display is a non-VGA PCI device and another GPU is VGA-class, kernel initialization can dereference a NULL pointer. The practical business concern is availability disruption on affected Linux systems, not confirmed data theft or remote compromise.

Executive priority

Prioritize patch tracking for Linux fleets with specialized graphics hardware, workstations, kiosks, GPU servers, or embedded systems. Broad emergency response is not supported by the provided evidence because exploitation is not reported and severity scoring is absent.

Technical view

The bug is in video/aperture sysfb_disable() handling. aperture_remove_conflicting_pci_devices() only disabled sysfb for VGA-class devices, while another path could free platform framebuffer resources first. A later VGA-class GPU probe could then call sysfb_disable() against already-freed state, causing a NULL pointer dereference. The fix passes and checks a device pointer before disabling sysfb.

Likely exposure

Exposure appears limited to affected Linux kernel versions and specific PCI graphics configurations involving a non-VGA primary boot display plus another VGA-class GPU. The bundle lists Linux kernel 6.5 through 6.10.8 and 6.11 as affected, but distribution backport status must be verified with the OS vendor.

Exploitation context

The source bundle does not show CISA KEV listing, public exploitation, or a CVSS score. The described condition depends on device probing and GPU class/resource ordering during boot or initialization. Treat this as a reliability and local-system availability risk unless vendor advisories provide stronger exploitation evidence.

Researcher notes

The core issue is incorrect sysfb_disable() targeting after framebuffer resource teardown. Validation should focus on affected kernel lineage, CONFIG_SCREEN_INFO-related builds, PCI display class combinations, and whether downstream kernels include commits 17e78f43de0c6da34204cc858b4cc05671ea9acf or b49420d6a1aeb399e5b107fc6eb8584d0860fbd7.

Mitigation direction

  • Update to a Linux kernel or vendor package containing the referenced stable fixes.
  • Check distribution advisories for backported patches before relying on upstream version numbers.
  • Prioritize systems with multiple GPUs or unusual boot display hardware.
  • If no package is available, follow vendor guidance for temporary operational workarounds.

Validation and detection

  • Inventory Linux kernel versions on systems with PCI graphics hardware.
  • Identify hosts with non-VGA primary display devices and additional VGA-class GPUs.
  • Confirm whether vendor kernel changelogs include the referenced stable commits.
  • Review boot logs for framebuffer, aperture, sysfb, or NULL pointer dereference messages.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-46698 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5ae3716cfdcd286268133867f67d0803847acefc, 5ae3716cfdcd286268133867f67d0803847acefc, 485ec8f8e1d8ae12aa1daa5ad345ba8940ad2db7, 6.1.47unaffected
LinuxLinux6.5, 0, 6.10.8, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.