CVE-2024-41052

What it actually does

Uninitialized count variable in vfio/pci hot-reset device collection leads to incorrect device counting and subsequent userspace crash when the get hot-reset info path is exercised.

Why it matters to the business

Applications relying on VFIO device passthrough or virtualization may experience unexpected crashes, causing service interruptions for workloads that depend on direct hardware access; urgency remains low given absence from known exploitation lists and stable low exploit probability.

How an attack unfolds

An attacker with local access to a system using VFIO triggers the get hot-reset info ioctl path, causing the kernel to use the uninitialized count and return malformed data that crashes the calling userspace process.

How to fix it

Upgrade the Linux kernel to version 6.6.41 or later, or apply the commit f476dffc52ea70745dcabf63288e770e50ac9ab3 in the stable tree; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel includes the fix by checking the version string or git commit; test that VFIO hot-reset info queries complete without crashing the client process.

Typical attack path

1. Obtain local access or execute code in a process with VFIO device access
2. Trigger the VFIO get hot-reset info operation
3. Kernel reads uninitialized count leading to malformed response
4. Userspace process crashes due to invalid data handling

How to detect it

Review system logs for kernel oops or userspace crashes immediately following VFIO device reset or hot-reset info queries; correlate with processes using VFIO ioctls.

What your security team should do

• Prioritize kernel updates on systems exposing VFIO devices to untrusted workloads
• Monitor kernel update channels for backports to older LTS branches
• Review VFIO usage in virtualization and container environments for exposure