CVE-2024-26814

What it actually does

The vfio_fsl_mc driver can invoke an interrupt handler when the eventfd_ctx trigger pointer is NULL (initial state or set to -1), bypassing checks needed for loopback testing paths despite igate serialization.

Why it matters to the business

Kernel instability or crashes on systems exposing fsl-mc devices via VFIO, disrupting virtualization workloads and device assignment until patched.

How an attack unfolds

An attacker with access to the vfio-fsl-mc interface sets the trigger eventfd to -1 and exercises loopback testing mechanisms to invoke the handler without a valid trigger, attempting to trigger invalid memory access.

How to fix it

Apply the fix present in commit aac7b3a13a43e302d91f94a120417b2fda737d0f for all cubecart/v6 (GIT) instances and equivalent upstream Linux kernel updates that enforce trigger validation before handler invocation.

How to confirm the fix worked

Confirm the patch is applied by inspecting the vfio_fsl_mc_irq handling code for explicit trigger NULL checks prior to handler calls in loopback paths; test with trigger set to -1 and verify no invalid access occurs.

Typical attack path

1. Obtain access to a vfio-fsl-mc device instance
2. Issue ioctl to set trigger eventfd to -1
3. Trigger loopback testing path to invoke handler
4. Exploit resulting NULL dereference or invalid access

How to detect it

Review kernel logs for oops/panic messages referencing vfio_fsl_mc_irq or eventfd_ctx NULL access; inspect audit logs for unusual vfio ioctl sequences setting eventfds to invalid values.

What your security team should do

• Prioritize kernel updates containing the vfio/fsl-mc trigger validation fix
• Audit systems exposing fsl-mc devices through VFIO for exposure
• Monitor EPSS and KEV status for any future increase in exploit activity