CVE-2024-53127

In the Linux kernel, the following vulnerability has been resolved:

Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"

The commit 8396c793ffdf ("mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K") increased the max_req_size, even for 4K pages, causing various issues:

• Panic booting the kernel/rootfs from an SD card on Rockchip RK3566
• Panic booting the kernel/rootfs from an SD card on StarFive JH7100
• "swiotlb buffer is full" and data corruption on StarFive JH7110

At this stage no fix have been found, so it's probably better to just revert the change.

This reverts commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890.

A flaw was found in the Linux kernel Synopsys DesignWare MMC (dw_mmc) driver. An upstream change (commit 8396c793ffdf, "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K") increased max_req_size even on systems using 4K pages, which caused the driver's internal DMA (IDMAC) operation to fail: kernel panics when booting the kernel or root filesystem from an SD card on Rockchip RK3566 and StarFive JH7100 platforms, and "swiotlb buffer is full" errors together with data corruption on StarFive JH7110 platforms. Upstream resolved the issue by reverting the offending commit, as no other fix had been found. Red Hat Product Security has rated this flaw as having Low impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the failure affects availability and storage data integrity on specific ARM64 hardware configurations rather than providing an attacker-controlled exploitation path; this is lower than the CVEORG score of 7.8, which assumes high confidentiality and integrity impacts that the technical evidence does not support. All Red Hat Enterprise Linux 6 through 9 kernel and kernel-rt streams are currently assessed as not affected by this issue. The only affected Red Hat offering is Fedora, where the kernel component is delegated with an out-of-support-scope (OOSS) resolution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.