Linux Kernel
CVE-2024-26810
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires winning precise kernel-level timing against interrupt paths, warranting AC:H over NVD's AC:L; AV:L and PR:L confirmed by VFIO local-access requirement.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Lock external INTx masking ops
Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outside of the core interrupt code.
In particular, irq_type is updated holding igate, therefore testing is_intx() requires holding igate. For example clearing DisINTx from config space can otherwise race changes of the interrupt configuration.
This aligns interfaces which may trigger the INTx eventfd into two camps, one side serialized by igate and the other only enabled while INTx is configured. A subsequent patch introduces synchronization for the latter flows.
AnalysisAI
Race condition in the Linux kernel's vfio/pci subsystem allows a local low-privileged attacker to exploit unsynchronized INTx interrupt masking operations, potentially achieving high impact across confidentiality, integrity, and availability. The flaw exists because config-space writes clearing the DisINTx bit and ioctl-based interrupt reconfiguration both modify shared interrupt state but operated without consistent locking on the igate mutex - meaning is_intx() checks could act on stale irq_type values. No public exploit exists and EPSS sits at 0.01% (1st percentile), indicating this is a targeted kernel hardening fix rather than an actively exploited vulnerability.
Technical ContextAI
VFIO (Virtual Function I/O) is the Linux kernel framework enabling user-space programs - most commonly QEMU/KVM hypervisors - to directly manage PCI devices for hardware passthrough to guest VMs. The vfio/pci component handles legacy PCI interrupt (INTx) routing for passthrough devices. The root cause is CWE-362 (Race Condition due to Concurrent Execution with Improper Synchronization): the kernel's irq_type field is updated while holding the igate mutex, but external INTx masking paths invoked through PCI config space (specifically clearing the DisINTx bit) did not acquire igate before testing is_intx(). This TOCTOU (Time-of-Check/Time-of-Use) window allowed the config-space path and the ioctl interrupt-reconfiguration path to race, potentially corrupting interrupt state. Affected products are confirmed as Linux kernel across multiple stable branches (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*), with eight separate stable-tree commits issued to remediate the flaw.
RemediationAI
Apply the latest kernel update from your Linux distribution vendor, which should incorporate one or more of the eight upstream stable-tree fix commits referenced at https://git.kernel.org/stable/c/03505e3344b0576fd619416793a31eae9c5b73bf and related links. Upstream fix is available (stable-tree commits only; a specific released patched kernel version was not independently confirmed from the provided data - verify with your distro's security advisory). As an immediate compensating control for environments not requiring VFIO PCI passthrough, unloading the vfio_pci module (rmmod vfio_pci) completely eliminates exposure with no impact to workloads that do not use hardware passthrough. For environments that require VFIO passthrough, restrict access to /dev/vfio/* device nodes using discretionary access controls so only trusted users and VM processes can interact with the vfio subsystem, reducing the pool of principals who can trigger the race.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today