# CVE-2024-50090: drm/xe/oa: Fix overflow in oa batch buffer

CVE-2024-50090 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-50090, released November 5, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-50090
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0022
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 5, 2024
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-50090

## Description

In the Linux kernel, the following vulnerability has been resolved:  drm/xe/oa: Fix overflow in oa batch buffer  By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at each call it appends a MI_BATCH_BUFFER_END, printing the warning below and then overflowing.  [  381.072016] ------------[ cut here ]------------ [  381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!                platform: LUNARLAKE subplatform: 1                graphics: Xe2_LPG / Xe2_HPG 20.04 step B0                media: Xe2_LPM / Xe2_HPM 20.00 step B0                tile: 0 VRAM 0 B                GT: 0 type 1  So here checking if batch buffer already have MI_BATCH_BUFFER_END if not append it.  v2: - simply fix, suggestion from Ashutosh  (cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.11.4-1 | [DEBIAN-CVE-2024-50090](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50090.md) | Nov 5, 2024 |
| Linux | linux Debian 14 | 6.11.4-1 | [DEBIAN-CVE-2024-50090](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50090.md) | Nov 5, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.