CVE-2024-49927

What it actually does

The vulnerability causes a kernel panic in mp_irqdomain_alloc when __add_pin_to_irq_node encounters an allocation failure for irq_pin_list during runtime IO-APIC pin mapping for ACPI or HPET devices, instead of propagating the error gracefully.

Why it matters to the business

Unexpected system crashes and reboots occur under memory pressure or allocation failure conditions during hardware interrupt setup, leading to unplanned downtime on affected Linux systems.

How an attack unfolds

An attacker or environmental condition induces memory allocation failures during ACPI GSI registration or HPET open operations that invoke mp_map_pin_to_irq; the unhandled failure in the IO-APIC domain allocation path triggers the legacy panic instead of falling back or returning an error.

How to fix it

Upgrade the Linux kernel to a version containing commit e479cb835feeb2abff97f25766e23b96a6eabe28 or later; apply the equivalent fixed package such as mod_md 1:2.0.8-8.module+el8.5.0+695+1fa8055e on Rocky Linux 8.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or patched package; reproduce allocation failure scenarios with tools such as failslab and verify graceful error handling without panic.

Typical attack path

1. Trigger low-memory or failslab conditions on a running system
2. Initiate operations that register IO-APIC routed interrupts such as HPET timer access or ACPI device initialization
3. Cause allocation failure inside mp_irqdomain_alloc leading to unhandled panic in __add_pin_to_irq_node

How to detect it

Search kernel logs and dmesg output for panic strings referencing IO-APIC allocation failures or irq_pin_list; correlate with ACPI or HPET initialization events around the time of crash.

• can not alloc irq_pin_list
• Kernel panic - not syncing: IO-APIC: failed to add irq-pin
• mp_irqdomain_alloc
• mp_map_pin_to_irq

What your security team should do

• Prioritize kernel updates on all affected systems given the public fix and potential for environmental triggering
• Review kernel logs for prior occurrences of 'can not alloc irq_pin_list' messages
• Enable memory pressure monitoring and testing in CI environments to validate interrupt allocation resilience