CVE-2024-27066

What it actually does

Failure to call vring_unmap_extra_packed on indirect descriptor tables when use_dma_api is true and premapped is enabled, leaving DMA mappings leaked in the virtio packed ring path.

Why it matters to the business

Gradual memory and DMA resource exhaustion on Linux hosts running virtio devices under the specific (unused) premapped indirect configuration, increasing operational risk in virtualized environments over long uptime.

How an attack unfolds

An attacker would need to trigger repeated allocation of indirect descriptor tables via a virtio driver that sets both use_dma_api and premapped, but because no production driver exercises this combination the leak is not reachable in practice.

How to fix it

Upgrade the Linux kernel to the commit e142169aca5546ae6619c39a575cda8105362100 or later stable trees containing the fix that checks vq->use_dma_api before deciding whether to unmap.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or verify that vq->use_dma_api is consulted in detach_buf_packed before any premapped indirect path.

Typical attack path

1. Identify or control a virtio device that exercises the packed ring with indirect descriptors
2. Force repeated queue operations that allocate premapped indirect tables
3. Rely on do_unmap remaining false so unmap calls are skipped
4. Accumulate leaked DMA mappings until host memory pressure occurs

How to detect it

Review kernel logs and virtio queue statistics for repeated allocation without corresponding unmap events; correlate with any custom premapped virtio usage.

What your security team should do

• Apply the referenced kernel commit or newer distribution packages immediately on all virtio hosts
• Audit custom or out-of-tree virtio drivers for any use of premapped indirect descriptors
• Monitor memory usage of virtio queues for unexpected growth as a compensating control