Linux kernel (drivers/vfio/pci): A tenant races a DisINTx write to emulated config space against a SET_IRQS ioctl, so

CVSS 7.8CVE-2024-26810Kernel, userspace & hypervisorcurated

Impact

A tenant races a DisINTx write to emulated config space against a SET_IRQS ioctl, so the interrupt configuration changes underneath the code that fires the eventfd. The interrupt path then uses a stale or NULL trigger, corrupting host kernel state or crashing the node from inside a tenant's own passthrough device.

Who can reach it

A tenant holding the vfio-pci device fd. Both halves of the race are plain tenant-issued operations: a config-space write clearing DisINTx in the PCI command register, and VFIO_DEVICE_SET_IRQS changing the INTx configuration. Conditional on a passthrough device using legacy INTx. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below (this fix and CVE-2024-26812 are the two halves of the same INTx hardening series - take both). Interim controls: pass through MSI/MSI-X-capable devices only, or drop /dev/vfio from the container.

References

https://git.kernel.org/stable/c/1e71b6449d55179170efc8dee8664510bb813b42 https://git.kernel.org/stable/c/3dd9be6cb55e0f47544e7cdda486413f7134e3b3 https://nvd.nist.gov/vuln/detail/CVE-2024-26810

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.