CVE-2024-50101

What it actually does

The domain_context_clear() function in the Intel VT-d IOMMU driver incorrectly invoked pci_for_each_dma_alias() on non-PCI devices, bypassing proper context entry handling and causing kernel hangs or undefined behavior.

Why it matters to the business

Linux systems using VT-d IOMMU with non-PCI devices may experience unexpected crashes or instability, leading to downtime and requiring kernel updates across server and desktop fleets; high ecosystem prevalence amplifies patch urgency.

How an attack unfolds

An attacker with local access or the ability to trigger IOMMU domain operations on non-PCI hardware can cause the kernel to execute invalid PCI alias logic, resulting in hangs; listed threat actors have targeted similar Linux kernel resource and bounds issues in 2024 campaigns.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.15.169 or later; apply the equivalent patch that adds the PCI device check before calling pci_for_each_dma_alias() and falls back to domain_context_clear_one() for non-PCI devices.

How to confirm the fix worked

Confirm the running kernel version is at or above the listed fixed releases; review IOMMU driver source for the added device-type guard; test IOMMU operations with non-PCI devices to ensure no hangs occur.

Typical attack path

1. Identify systems with VT-d enabled and non-PCI devices attached
2. Trigger IOMMU domain context clearing operations via driver or device interaction
3. Invoke domain_context_clear() path that reaches the incorrect pci_for_each_dma_alias() call
4. Cause kernel hang or crash to achieve denial of service

How to detect it

Search kernel logs and dmesg for IOMMU context clearing errors or hangs on non-PCI devices; review audit trails of IOMMU domain operations around the time of instability; correlate with threat actor patterns targeting Linux kernel resource issues.

• kernel: iommu vt-d domain_context_clear
• pci_for_each_dma_alias called on non-PCI device
• unexpected IOMMU context hang

What your security team should do

• Prioritize kernel upgrades on all affected Linux hosts within the CISA-style remediation window if applicable
• Audit IOMMU configurations and device inventories to identify non-PCI hardware exposure
• Monitor kernel logs for IOMMU-related hangs during routine operations
• Apply updates before enabling VT-d on systems with mixed device types