Linux kernel (drivers/vfio/pci): For passthrough devices whose INTx has to be masked at the irqchip, the IRQ is enabled

CVSS 5.5CVE-2024-27437Kernel, userspace & hypervisorcurated

Impact

For passthrough devices whose INTx has to be masked at the irqchip, the IRQ is enabled before vfio disables it, so an interrupt arriving in that window double-increments the disable depth. The line stays disabled with no way for the tenant to recover it through vfio, and where that IRQ line is shared with other devices on the host, they stop receiving interrupts too.

Who can reach it

A tenant holding a vfio-pci device fd enabling INTx, with the device asserting its interrupt inside the request_irq window. No host root, and the tenant does not have to win a tight race - it controls when the device asserts. Conditional on a passthrough function that lacks DisINTx support, which is what makes vfio use the exclusive masked-INTx path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: pass through only MSI/MSI-X-capable functions, and avoid assigning devices whose INTx line is shared with host-owned devices.

References

https://git.kernel.org/stable/c/26389925d6c2126fb777821a0a983adca7ee6351 https://git.kernel.org/stable/c/561d5e1998d58b54ce2bbbb3e843b669aa0b3db5 https://nvd.nist.gov/vuln/detail/CVE-2024-27437

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.