CVE-2024-56680

What it actually does

The flaw permits interrupt service routine execution on a disabled IPU6 device sharing an IRQ line, causing reads of 0xffffffff from ISR_STATUS and unconditional handling of all IRQ cases, resulting in system hangs due to a race condition between device state transitions and shared interrupt delivery.

Why it matters to the business

Produces unexpected system instability and full hangs on Linux hosts using Intel IPU6 media hardware, raising operational downtime, support burden, and patch urgency across kernel-dependent environments with broad ecosystem reach.

How an attack unfolds

An attacker triggers a shared IRQ while the IPU6 device is disabled or suspended; the kernel reads an all-ones status value and processes unprepared IRQ vectors, hanging the system. Similar Linux kernel race and resource issues have appeared in zero-day campaigns by espionage and financially motivated actors.

How to fix it

Apply the upstream fix in commit ed4524c87249edc3104f6bb28ab11325bed3d536 or later; on Ubuntu 16.04 install opencv 2.4.9.1+dfsg-1.5ubuntu1.1 or newer; on Ubuntu 18.04 install opencv 3.2.0+dfsg-4ubuntu0.1 or newer. Ensure pm_runtime_get_if_active checks and synchronize_irq calls are present in suspend paths.

How to confirm the fix worked

Confirm the corrected pm_runtime_get_if_active guard and synchronize_irq usage in the ipu6 IRQ handler and suspend routine; test shared-IRQ scenarios under device disable/suspend to verify no 0xffffffff status processing occurs.

Typical attack path

1. Locate Linux systems exposing Intel IPU6 with shared IRQs
2. Force device disable or runtime suspend
3. Generate an interrupt from a co-located device on the shared line
4. Observe kernel processing of invalid ISR status leading to hang or crash

How to detect it

Review kernel logs for media/IPU6 IRQ handler entries coinciding with device suspend events or system hangs; examine crash dumps for uninitialized resource or out-of-bounds access patterns tied to ISR_STATUS reads.

What your security team should do

• Immediately update affected kernels and opencv packages to the listed fixed versions
• Prioritize systems with Intel IPU6 hardware given the shared-IRQ exposure
• Monitor kernel logs and crash reports for media device IRQ anomalies until patches are deployed