CVE-2024-46689 – A memory mapping vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-46689?

CVE-2024-46689 has a CVSS score of 5.5 (MEDIUM). A memory mapping vulnerability in the Linux kernel's Qualcomm cmd-db driver could cause denial-of-service on affected devices. The driver incorrectly maps shared memory as write-back (WB) instead of write-combining (WC), potentially triggering secure interrupts that lead to endless loops in Trust Zone when using certain hypervisors. This affects Linux systems with Qualcomm SoCs using the cmd-db driver, particularly when running under hypervisors like Xen or KVM.

📋 TL;DR

A memory mapping vulnerability in the Linux kernel's Qualcomm cmd-db driver could cause denial-of-service on affected devices. The driver incorrectly maps shared memory as write-back (WB) instead of write-combining (WC), potentially triggering secure interrupts that lead to endless loops in Trust Zone when using certain hypervisors. This affects Linux systems with Qualcomm SoCs using the cmd-db driver, particularly when running under hypervisors like Xen or KVM.

💻 Affected Systems

Products:

Linux kernel with Qualcomm cmd-db driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions running on Qualcomm SoCs

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Qualcomm SoCs using the cmd-db driver, particularly when running under hypervisors other than Qualcomm Hypervisor (e.g., Xen, KVM).

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes completely unresponsive due to endless secure interrupt loops in Trust Zone, requiring physical power cycle to recover.

🟠

Likely Case

System instability or crashes when using non-Qualcomm hypervisors (Xen/KVM) on affected Qualcomm hardware.

🟢

If Mitigated

No impact if using Qualcomm Hypervisor or patched kernel versions.

🌐 Internet-Facing: LOW - Requires local access to affected hardware and specific hypervisor configurations.

🏢 Internal Only: MEDIUM - Could affect embedded devices, IoT systems, or servers using affected Qualcomm hardware with alternative hypervisors.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific hardware (Qualcomm SoC), specific driver usage, and alternative hypervisor configuration. This appears to be a reliability issue rather than a security bypass.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 0ee9594c974368a17e85a431e9fe1c14fb65c278 or later

Vendor Advisory: https://git.kernel.org/stable/c/0ee9594c974368a17e85a431e9fe1c14fb65c278

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Use Qualcomm Hypervisor

linux

Continue using Qualcomm Hypervisor instead of alternative hypervisors (Xen/KVM)

Disable cmd-db driver

linux

Remove or blacklist the cmd-db driver if not required

echo 'blacklist cmd-db' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Avoid using Xen or KVM hypervisors on affected Qualcomm hardware
Ensure systems use Qualcomm Hypervisor exclusively

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if cmd-db driver is loaded: 'uname -r' and 'lsmod | grep cmd_db'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: 'git log --oneline | grep -E "(0ee9594c9743|62c2d63605ca|d9d48d70e922|eaff392c1e34|ef80520be0ff)"'

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Secure interrupt errors in dmesg
Hypervisor crash logs

Network Indicators:

Sudden loss of connectivity from affected systems

SIEM Query:

source="kernel" AND ("cmd-db" OR "secure interrupt" OR "Trust Zone loop")

📊 Metadata

CVE ID: CVE-2024-46689

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-787

Published: September 13, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-46689, you might also want to check these: