Linux kernel (drivers/vfio/platform): A tenant holding a vfio-platform device can loopback-trigger an interrupt before

Impact

A tenant holding a vfio-platform device can loopback-trigger an interrupt before any signaling eventfd has been configured, dereferencing a NULL trigger from the interrupt path and taking the host kernel down. Same defect class as the vfio-pci INTx bugs - the device fd's interrupt state and its eventfd lifetime were not tied together.

Who can reach it

A container or VM holding a vfio-platform device fd, calling VFIO_DEVICE_SET_IRQS with the loopback trigger flags before ever registering an eventfd. No host root where it applies. Conditional on the vfio-platform driver being loaded with a non-PCI platform device assigned - an ARM/embedded SoC configuration, so a standard x86 GPU node is not exposed.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: blacklist vfio-platform and vfio-amba on fleets that never assign platform devices, which is the normal case for x86 GPU nodes.

References