CVE-2024-35843

What it actually does

Use-after-free in the Intel VT-d IOMMU I/O page fault reporting path caused by a device being released from the probed device rbtree between device_rbtree_find() and iopf_get_dev_fault_param() without proper synchronization.

Why it matters to the business

May cause kernel crashes, denial of service, or local privilege escalation on Linux systems using Intel VT-d IOMMU, increasing downtime and security risk for servers and workstations; low exploitability keeps overall exposure limited despite wide Linux deployment.

How an attack unfolds

An attacker with local access triggers concurrent IOMMU device release and I/O page fault events to hit the unsynchronized window, dereferencing a freed device structure to corrupt kernel memory or escalate privileges; the race is theoretically possible but rare in practice and no named threat actors have been observed exploiting it.

How to fix it

Update the Linux kernel to a version containing commit 3d39238991e745c5df85785604f037f35d9d1b15 or later; apply the vendor-supplied stable or distribution kernel update that backports the mutex synchronization in the iopf reporting path.

How to confirm the fix worked

Verify the running kernel contains commit 3d39238991e745c5df85785604f037f35d9d1b15 or an equivalent backport; confirm the mutex is present around the iopf_get_dev_fault_param call site in the IOMMU driver source or binary.

Typical attack path

1. Obtain local code execution on a Linux system with VT-d IOMMU enabled
2. Craft or trigger device attach/detach operations while generating I/O page faults
3. Win the narrow race between device_rbtree_find and fault parameter access
4. Use the resulting dangling pointer for memory corruption or privilege escalation

How to detect it

Examine kernel logs for IOMMU fault handling entries around device removal or release events; look for crashes or warnings referencing iopf or vt-d device lookup paths.

What your security team should do

• Prioritize kernel updates on all systems using Intel VT-d IOMMU within normal patching cycles given low EPSS and no KEV listing
• Monitor kernel update channels for the specific commit and schedule testing in IOMMU-enabled environments
• Review IOMMU-related kernel logs for unusual device release or fault events as a general hygiene measure