CVE-2024-40945

What it actually does

iommu_sva_bind_device() can return NULL instead of an ERR_PTR on error when CONFIG_IOMMU_SVA is disabled, causing callers that only use IS_ERR() to dereference a null pointer.

Why it matters to the business

Kernel stability risk on Linux systems using IOMMU SVA features; exposure is limited to specific kernel configurations and does not affect normal operation.

How an attack unfolds

An attacker would need local access and a kernel configuration without CONFIG_IOMMU_SVA enabled, then trigger a driver path (idxd or uacce) that calls iommu_sva_bind_device() and treats a NULL return as a valid handle, leading to a NULL dereference crash.

How to fix it

Update the Linux kernel to the fixed commit 700f564758882db7c039dfba9443fe762561a3f8 or later stable releases containing this change; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 700f564758882db7c039dfba9443fe762561a3f8; verify CONFIG_IOMMU_SVA is either enabled or that iommu_dev_enable_feature returns an error before bind calls occur.

Typical attack path

1. Obtain local code execution on a Linux system
2. Ensure the kernel is built without CONFIG_IOMMU_SVA
3. Invoke device driver code paths that call iommu_sva_bind_device()
4. Trigger NULL pointer dereference via unchecked return value

How to detect it

Review kernel logs for oops or NULL pointer dereference messages involving iommu_sva_bind_device or related IOMMU SVA functions; check for calls from idxd or uacce drivers.

What your security team should do

• Prioritize kernel upgrades to the listed fixed commit on all production Linux hosts
• Audit kernel configs for CONFIG_IOMMU_SVA usage and driver dependencies
• Monitor for kernel oops or NULL dereference crashes in IOMMU-related drivers