CVE-2024-53092

What it actually does

NULL pointer dereference during admin virtqueue resource cleanup in vp_modern_avq_cleanup and vp_del_vqs when the info pointer is incorrectly fetched from vp_dev->vqs[] instead of vp_dev->admin_vq.info, triggered on vp_reset paths.

Why it matters to the business

Kernel crashes and system instability in virtualized Linux environments using virtio devices, leading to unplanned downtime and potential loss of availability for workloads relying on virtio networking or storage.

How an attack unfolds

An attacker with local access or control over a guest VM triggers virtio device removal or reset operations (such as module unload in virtio_net), causing the kernel to follow a NULL pointer during admin vq cleanup in the virtio_pci driver.

How to fix it

Upgrade the Linux kernel to a version containing commit 018d3d4ad4be7fbc95d8a2367642a32d21df55c7 or later; apply vendor backports for stable trees; avoid unprivileged module operations on virtio devices until patched.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source or package; attempt virtio device attach/detach and reset sequences in a test environment to confirm absence of the NULL dereference call trace.

Typical attack path

1. Obtain local code execution or guest VM control on an affected Linux kernel
2. Load or interact with virtio_pci and virtio_net drivers
3. Trigger device removal or reset via virtio_reset_device or modprobe removal
4. Execute vp_reset which calls vp_modern_avq_cleanup using the wrong info pointer
5. Induce kernel NULL pointer dereference and crash

How to detect it

Review kernel logs for BUG: kernel NULL pointer dereference traces referencing vp_reset, vp_modern_avq_cleanup, or virtio_pci during module unload or device removal events.

What your security team should do

• Prioritize kernel updates on all systems exposing virtio devices
• Monitor for virtio-related kernel oops in system logs
• Restrict unprivileged access to virtio driver loading until patched