CVE-2024-26812

What it actually does

A flaw in vfio/pci INTx handling allows deconfiguration of the eventfd trigger which unregisters the IRQ handler while still permitting eventfd signaling with a NULL context via SET_IRQS ioctl or unmask irqfd when a device interrupt is pending, resulting in memory corruption.

Why it matters to the business

Local users can trigger denial of service or system instability in environments relying on VFIO PCI passthrough for virtualization, increasing operational risk for dependent workloads until systems are updated.

How an attack unfolds

An attacker with local access configures a VFIO PCI device, deconfigures the INTx eventfd to unregister the handler, then uses the SET_IRQS ioctl or pending interrupt unmask path to signal through a NULL context, exploiting the race between ioctl and asynchronous irqfd paths.

How to fix it

Upgrade the Linux kernel or affected libvirt package to a version containing commit 07bb8ff4dd0ca0224754c582390f4a873597c4b9; rebuild and reboot systems using VFIO PCI passthrough.

How to confirm the fix worked

Verify the running kernel contains the persistent INTx handler change, confirm no NULL context paths remain by reviewing vfio/pci interrupt code, and test device assignment and interrupt delivery under load.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Attach to a VFIO PCI device via libvirt or direct ioctl
3. Issue SET_IRQS to deconfigure the INTx eventfd trigger
4. Trigger a device interrupt while the handler context is NULL
5. Observe resulting kernel crash or corruption

How to detect it

Review kernel logs for NULL pointer dereferences or crashes in vfio_pci paths during interrupt configuration changes; inspect audit logs for frequent SET_IRQS or irqfd operations on VFIO devices.

What your security team should do

• Prioritize patching systems that expose VFIO PCI devices to untrusted local users
• Apply the fixed commit or later kernel package within standard change windows
• Review virtualization configurations to limit unnecessary VFIO device exposure