Linux kernel (drivers/vfio/pci): A tenant holding a passthrough PCI device can make the kernel signal an interrupt

CVSS 7.8CVE-2024-26812Kernel, userspace & hypervisorcurated

Impact

A tenant holding a passthrough PCI device can make the kernel signal an interrupt eventfd whose context has already been torn down, dereferencing a NULL/stale pointer from interrupt context. The host kernel corrupts or dies, and every other tenant sharing the node goes down with it.

Who can reach it

A container or VM holding /dev/vfio/<group> plus the device fd. The tenant deconfigures the INTx eventfd (VFIO_DEVICE_SET_IRQS with fd -1) while a device interrupt is pending, then drives the loopback trigger through SET_IRQS or the unmask irqfd - the irqfd path runs asynchronously to the ioctl mutex, so it is not serialized. Conditional on vfio-pci and a passthrough device that uses legacy INTx rather than MSI/MSI-X. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below (backported across the 6.1/6.6/6.7 stable lines). Interim controls: only pass through devices using MSI/MSI-X, or remove the /dev/vfio device nodes from tenant containers.

References

https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899 https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897 https://nvd.nist.gov/vuln/detail/CVE-2024-26812

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.