CVE-2024-26813

What it actually does

The vfio-platform SET_IRQS ioctl permits loopback IRQ triggering prior to eventfd configuration, resulting in a NULL pointer dereference during interrupt handling.

Why it matters to the business

Systems relying on VFIO for device assignment in virtualized environments face potential crashes or denial of service that can disrupt workloads and require kernel updates across affected Linux deployments.

How an attack unfolds

An attacker with access to the vfio-platform device interface issues a SET_IRQS ioctl to trigger an interrupt before a valid signaling eventfd exists, causing the handler to dereference a NULL trigger pointer; the provided threat actor context of Android Kernel Remote Code Execution Vulnerability does not alter the core local vector.

How to fix it

Update the Linux kernel to the fixed commit 07afdfd8a68f9eea8db0ddc4626c874f29d2ac5e or later stable versions that register all IRQs in a disabled state during device open.

How to confirm the fix worked

Confirm the running kernel contains commit 07afdfd8a68f9eea8db0ddc4626c874f29d2ac5e, then verify that SET_IRQS operations without a configured eventfd no longer produce NULL dereferences via targeted testing or kernel logs.

Typical attack path

1. Obtain access to a vfio-platform device via userspace driver or container privileges
2. Call SET_IRQS ioctl to request IRQ setup without first configuring a valid eventfd trigger
3. Trigger loopback interrupt to invoke the unregistered handler
4. Trigger NULL pointer dereference leading to kernel panic or oops

How to detect it

Review kernel logs for NULL pointer dereference oops messages involving vfio-platform IRQ handlers; inspect audit logs for unusual SET_IRQS ioctl sequences on vfio devices.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems exposing vfio-platform devices
• Audit VFIO usage to ensure only trusted users or containers can access platform devices
• Monitor kernel update channels for backports of the IRQ handler registration change