Database/Kernel, userspace & hypervisor
Linux kernel (drivers/vfio/platform): A tenant holding a vfio-platform device can loopback-trigger an interrupt before
Impact
A tenant holding a vfio-platform device can loopback-trigger an interrupt before any signaling eventfd has been configured, dereferencing a NULL trigger from the interrupt path and taking the host kernel down. Same defect class as the vfio-pci INTx bugs - the device fd's interrupt state and its eventfd lifetime were not tied together.
Who can reach it
A container or VM holding a vfio-platform device fd, calling VFIO_DEVICE_SET_IRQS with the loopback trigger flags before ever registering an eventfd. No host root where it applies. Conditional on the vfio-platform driver being loaded with a non-PCI platform device assigned - an ARM/embedded SoC configuration, so a standard x86 GPU node is not exposed.
What to do
The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: blacklist vfio-platform and vfio-amba on fleets that never assign platform devices, which is the normal case for x86 GPU nodes.
References
Related entries
- Linux kernel (drivers/vfio/platform): Vfio-platform never bounds-checked the count and offset a caller passes toCVE-2025-21687 · Linux kernel (drivers/vfio/platform)High
- Linux kernel (drivers/vfio/fsl-mc): The eventfd trigger for a vfio-fsl-mc interrupt starts out NULL and becomes NULLCVE-2024-26814 · Linux kernel (drivers/vfio/fsl-mc)Medium
- Linux kernel (HID): Uninitialised HID report buffer leaks kernel memoryCVE-2024-50302 · Linux kernel (HID)Medium
- Linux kernel (drivers/pci/endpoint): Pci_epc_destroy() releases the PCI domain ID using a device object it has alreadyCVE-2024-56561 · Linux kernel (drivers/pci/endpoint)Medium
- Linux kernel (drivers/pci/endpoint): The endpoint function core calls list_del() on a structure that is a list HEADCVE-2025-39783 · Linux kernel (drivers/pci/endpoint)Medium
- Linux kernel (drivers/vfio/cdx): A tenant can call the interrupt-configuration ioctl with the trigger flags before MSICVE-2026-46034 · Linux kernel (drivers/vfio/cdx)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.