{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26812","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.180Z","datePublished":"2024-04-05T08:24:42.627Z","dateUpdated":"2026-08-05T11:27:33.639Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:33.639Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Create persistent INTx handler\n\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\n\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those.  The igate mutex cannot be acquired from the\natomic context of the eventfd wake function.  Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\n\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd.  Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through the VFIO_DEVICE_SET_IRQS ioctl (and config-space writes/irqfd) on an open vfio-pci device file descriptor, requiring local access to /dev/vfio/*. There is no network-facing path to this code.\nAC:L - The NULL-context signal is fully deterministic — three consecutive SET_IRQS ioctls reach eventfd_signal(NULL) with no timing or layout dependency. For the additional eventfd_ctx use-after-free, the attacker controls both sides of the race (one thread looping trigger replacement, another firing the unmask irqfd and the device's own INTx line).\nPR:L - No capability is checked anywhere on the path; CAP_SYS_RAWIO applies only to no-IOMMU mode. Access is granted by ordinary file permissions on the VFIO device/group node, which is exactly the intended deployment for unprivileged userspace drivers (DPDK/SPDK), libvirt-run QEMU as a non-root user, and containers with delegated /dev/vfio access.\nUI:N - The attacker performs the entire sequence itself via ioctls on a device fd it already holds; no victim action, mount, or file-open is required.\nS:U - The bug is an in-kernel software defect reached through a legitimate ioctl by the process that already owns the device; no IOMMU/DMA boundary is bypassed and no guest-to-host boundary is crossed. Vulnerable and impacted components are both the host kernel.\nC:H - The commit also closes a use-after-free of the eventfd_ctx released by the ioctl path while the asynchronous irqfd inject workqueue is still dereferencing it (the reason synchronize_irq()/vfio_virqfd_flush_thread() were added). Control of the reclaimed slab object yields an arbitrary kernel read primitive via the wait-queue walk.\nI:H - The same use-after-free lets eventfd_signal() write into a reallocated, attacker-sprayed object (ctx->count++) and call a function pointer through wake_up_locked_poll()'s wait-queue traversal, giving a control-flow hijack primitive. On configurations permitting low-address mappings, the NULL dereference itself becomes an attacker-controlled write/call.\nA:H - Any user with access to a VFIO device can reliably oops the kernel in three ioctls via eventfd_signal(NULL) taking a spinlock at a NULL offset, and the use-after-free adds further memory corruption crashes. With panic_on_oops this is a full host panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/vfio/pci/vfio_pci_intrs.c"],"versions":[{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"b18fa894d615c8527e15d96b76c7448800e13899","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"27d40bf72dd9a6600b76ad05859176ea9a1b4897","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"4cb0d7532126d23145329826c38054b4e9a05e7c","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"7d29d4c72c1e196cce6969c98072a272d1a703b3","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"69276a555c740acfbff13fb5769ee9c92e1c828e","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"4c089cefe30924fbe20dd1ee92774ea1f5eca834","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"0e09cf81959d9f12b75ad5c6dd53d237432ed034","status":"affected","versionType":"git"},{"version":"89e1f7d4c66d85f42c3d52ea3866eb10cadf6153","lessThan":"18c198c96a815c962adc2b9b77909eec0be7df4d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/vfio/pci/vfio_pci_intrs.c"],"versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","status":"unaffected","versionType":"semver"},{"version":"5.4.274","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.215","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.154","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.84","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.24","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.12","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8.3","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.4.274"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.215"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.15.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.84"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.6.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.7.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899"},{"url":"https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897"},{"url":"https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c"},{"url":"https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3"},{"url":"https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e"},{"url":"https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834"},{"url":"https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034"},{"url":"https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d"}],"title":"vfio/pci: Create persistent INTx handler","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26812","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-05T14:00:34.055358Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-07-05T17:20:45.884Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.527Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:49:29.134Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]},"dataVersion":"5.2"}