CVE-2024-27067

What it actually does

Race condition in xen/evtchn event channel unbinding allows a handler to be invoked one final time under CONFIG_DEBUG_SHIRQ builds, triggering an unintended WARN() in the user_event handler.

Why it matters to the business

Low operational impact limited to noisy kernel warnings in debug builds; no evidence of active exploitation or ransomware use despite nearly 900 days of public disclosure and stable low EPSS.

How an attack unfolds

An attacker would bind then unbind a user event channel while the kernel is compiled with CONFIG_DEBUG_SHIRQ so that the final handler call occurs after unbinding begins, surfacing the warning; no named threat actors or campaigns are known to target this condition.

How to fix it

Upgrade affected packages to the listed fixed versions: systemd on Debian 11 to 247.3-7+deb11u2, on Debian 12/13 to 252.4-1, or systemd GIT to commit b7641425659243c09473cd8fb3aef2c0d4a3eb9c.

How to confirm the fix worked

Confirm the unbinding flag exists in struct user_event and that the handler short-circuits when the flag is set; verify package versions match the fixed releases above.

Typical attack path

1. Locate system using Xen event channels
2. Trigger user event channel bind/unbind sequence
3. Ensure kernel built with CONFIG_DEBUG_SHIRQ
4. Observe resulting WARN() in logs

How to detect it

Search kernel logs and dmesg for xen/evtchn handler warnings triggered during event channel teardown; no active exploitation indicators are known.

What your security team should do

• Apply the listed fixed package versions immediately on all affected Debian and GIT deployments
• Rebuild any custom kernels without CONFIG_DEBUG_SHIRQ if warnings persist
• Monitor kernel logs for xen/evtchn WARN messages as a temporary detection measure