CVE-2024-26776

What it actually does

The hisi_sfc_v3xx interrupt handler fails to return IRQ_NONE when no interrupt is pending, resulting in a subsequent call to complete() that dereferences a null pointer at address 0x8 and triggers a kernel NULL pointer dereference.

Why it matters to the business

Systems using the affected SPI controller may experience unexpected kernel crashes and reboots, leading to service interruptions and potential data loss on Linux-based devices or servers.

How an attack unfolds

An attacker with the ability to trigger spurious or empty interrupts on the hisi-sfc-v3xx device causes the ISR to skip proper handling and invoke complete() on an uninitialized structure, producing an immediate kernel panic.

How to fix it

Update the Linux kernel to a version containing commit e94da8aca2e78ef9ecca02eb211869eacd5504e5 (or later stable equivalents) so that the ISR correctly returns IRQ_NONE when no interrupt is detected.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, then exercise the SPI controller under interrupt-heavy workloads and verify that no NULL pointer dereference occurs in hisi_sfc_v3xx_isr.

Typical attack path

1. Gain access to a system with the vulnerable spi_hisi_sfc_v3xx driver loaded
2. Trigger hardware conditions that generate an empty interrupt event
3. Interrupt handler executes without detected interrupt and calls complete()
4. Kernel panics on NULL pointer dereference

How to detect it

Search kernel logs for the exact panic strings 'Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008' and 'hisi_sfc_v3xx_isr' near complete() frames; review dmesg or journalctl output around crash timestamps.

• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
• hisi_sfc_v3xx_isr+0x2c/0x40
• complete+0x54/0x100

What your security team should do

• Prioritize kernel upgrades on all systems exposing the hisi-sfc-v3xx SPI controller
• Monitor vendor advisories for backported fixes in distribution kernels
• Test updated kernels in staging environments before broad deployment