Linux kernel (drivers/iommu/intel): On device release VT-d could dereference a NULL domain and, separately, leave the

CVSS 6.0CVE-2024-27079Kernel, userspace & hypervisorcurated

Impact

On device release VT-d could dereference a NULL domain and, separately, leave the device's scalable-mode context entry uncleared. A context entry that survives device release is a translation the hardware still honours for whatever occupies that bus/device/function next - the stale-mapping shape of a DMA isolation break - and the NULL dereference itself oopses the host.

Who can reach it

Reached on device release/detach: a device leaving its IOMMU group, which on a GPU node happens on driver unbind, VF teardown, or when a tenant's passthrough function is returned to the host. The upstream reproducer is the kdump kernel, where deferred attach means the domain pointer is not yet assigned. Needs host-side device lifecycle events rather than a tenant ioctl - but the residue it leaves is exactly what the next tenant on that BDF would inherit.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: avoid rapid rebind/reassign cycles of passthrough functions between tenants, and force a full device reset and re-probe before handing a function to a new tenant.

References

https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d https://nvd.nist.gov/vuln/detail/CVE-2024-27079

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.