Security readout for executives and security teams
Plain-English summary
This is a Linux kernel flaw in the AMD GPU KFD migration path. The kernel used inconsistent DMA mapping directions, which can trigger DMA core warnings during GPU memory migration. The sources do not provide CVSS, impact detail, or evidence of exploitation, so urgency depends on whether affected Linux kernels run AMD GPU workloads.
Executive priority
Treat this as a targeted kernel maintenance item, not an emergency, unless your environment relies on AMD GPU compute on affected kernels. Patch through normal kernel update channels and prioritize exposed GPU compute systems first.
Technical view
The issue is in drm/amdkfd SVM migration DMA handling. The DMA map direction did not match the unmap direction; the kernel fix aligns this by mapping as bidirectional. The supplied trace shows a DMA debug warning in check_unmap during an AMDGPU/KFD workload.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the AMDGPU KFD/SVM migration path in use. Systems without AMD GPU compute workloads are less likely to exercise the vulnerable path. Exact distribution exposure depends on vendor backports and kernel package status.
Exploitation context
CISA KEV is false in the supplied data. The bundle provides no public exploit, weaponization report, CVSS score, or attacker-controlled trigger details. The observable evidence is a kernel warning during a GPU runtime test workload, not confirmed real-world exploitation.
Researcher notes
Evidence is incomplete: no CWE, CVSS, exploitability analysis, or security impact beyond the DMA warning is supplied. Validation should focus on kernel branch mapping, commit presence, distribution backports, and whether amdgpu KFD SVM migration is reachable in deployed workloads.
Mitigation direction
- Update to a vendor kernel containing the referenced stable Linux fixes.
- For Debian LTS systems, review and apply the cited Debian LTS advisory update.
- Prioritize AMD GPU compute hosts using affected Linux kernel branches.
- If updates are unavailable, monitor vendor guidance for supported mitigations.
- Avoid direct wrangler or deployment assumptions; this CVE is kernel-level.
Validation and detection
- Inventory Linux kernel versions on hosts with AMD GPU workloads.
- Check whether vendor kernel packages include the referenced stable commits.
- Review kernel logs for DMA debug warnings in amdgpu or amdkfd paths.
- Confirm patched systems run fixed kernel packages after reboot.
- Track distribution advisories for backported fixes and affected status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-57897 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/22d36ad92e5703e2e9bdf228990c0999d5d53ea3CVE reference, Linux
- https://git.kernel.org/stable/c/465b18e1c518e799593797d4603f4ab76de4e1d8CVE reference, Linux
- https://git.kernel.org/stable/c/d0fafe701c6aca785cc8685f9f76fdc73e662f47CVE reference, Linux
- https://git.kernel.org/stable/c/de39f72953953ca7a2630f9b80ccdfef40568746CVE reference, Linux
- https://git.kernel.org/stable/c/5c3de6b02d38eb9386edf50490e050bb44398e40CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.