Linux kernel (drivers/vfio/pci): A tenant races a DisINTx write to emulated config space against a SET_IRQS ioctl, so

Impact

A tenant races a DisINTx write to emulated config space against a SET_IRQS ioctl, so the interrupt configuration changes underneath the code that fires the eventfd. The interrupt path then uses a stale or NULL trigger, corrupting host kernel state or crashing the node from inside a tenant's own passthrough device.

Who can reach it

A tenant holding the vfio-pci device fd. Both halves of the race are plain tenant-issued operations: a config-space write clearing DisINTx in the PCI command register, and VFIO_DEVICE_SET_IRQS changing the INTx configuration. Conditional on a passthrough device using legacy INTx. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below (this fix and CVE-2024-26812 are the two halves of the same INTx hardening series - take both). Interim controls: pass through MSI/MSI-X-capable devices only, or drop /dev/vfio from the container.

References