CVE-2024-46762

What it actually does

Race condition between privcmd_irqfd_assign and privcmd_irqfd_deassign allows concurrent access to a kirqfd instance that has been removed from the list and freed, resulting in use-after-free and kernel oops.

Why it matters to the business

Systems running affected Linux kernels with Xen privcmd may experience unexpected crashes and reduced availability in virtualized environments; no widespread exploitation observed and low exploit probability.

How an attack unfolds

An attacker with local access issues simultaneous ioctl calls to assign and deassign IRQ file descriptors on the Xen privcmd device; the deassign path frees the structure while the assign path is still using it after releasing locks, triggering the use-after-free.

How to fix it

Apply the upstream fix in commit e997b357b13a7d95de31681fc54fcc34235fa527 or upgrade to a kernel containing this change; rebuild and deploy the patched kernel across affected Xen hosts.

How to confirm the fix worked

Verify the presence of commit e997b357b13a7d95de31681fc54fcc34235fa527 in the running kernel source or confirm the patched behavior by exercising concurrent assign/deassign ioctls without oops.

Typical attack path

1. Gain local user access on a Xen-enabled Linux system
2. Open the Xen privcmd device file
3. Issue concurrent privcmd_irqfd_assign and privcmd_irqfd_deassign ioctl calls from multiple threads
4. Trigger dereference of the freed kirqfd structure causing kernel oops

How to detect it

Inspect kernel logs and dmesg for oops or panic messages referencing privcmd, irqfd, or kirqfd structures; correlate with processes performing ioctl operations on /dev/xen/privcmd.

• kirqfd
• privcmd_irqfd_assign
• privcmd_irqfd_deassign

What your security team should do

• Prioritize kernel updates on all Xen hosts within standard patch windows
• Monitor kernel logs for oops involving privcmd or kirqfd
• Review Xen workload isolation to limit local access where feasible