What is the CVSS score of CVE-2024-35843?

CVE-2024-35843 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-35843?

CVE-2024-35843 is a Linux kernel vulnerability in the Intel IOMMU VT-d subsystem enabling local privilege escalation to full system compromise.. A patch is available.

How to fix or mitigate CVE-2024-35843?

Within 24 hours, identify all systems running affected Linux kernel versions and assess which have Intel VT-d IOMMU enabled, prioritizing production infrastructure and systems permitting local user access. Within 7 days, contact your Linux distribution vendor for the patched kernel version and validate the fix in a test environment to confirm the IOMMU device race condition is resolved. Within 30 days, deploy the vendor-released patch across all affected systems through standard change management and reboot to load the corrected kernel.

Linux Kernel CVE-2024-35843

HIGH

Use After Free (CWE-416)

2024-05-17 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Race condition exploitation requires winning a narrow, non-deterministic timing window in the kernel, warranting AC:H rather than the NVD-assigned AC:L; all other metrics align with NVD.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:41 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:40 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

6.8 (MEDIUM) 8.8 (HIGH)

CVE Published

May 17, 2024 - 15:15 cve.org

MEDIUM 6.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Use device rbtree in iopf reporting path

The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with device_rbtree_find() to search the device within the probed device rbtree.

The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after device_rbtree_find() and before iopf_get_dev_fault_param(), which would cause a use-after-free problem.

Add a mutex to synchronize the I/O page fault reporting path and the IOMMU release device path. This lock doesn't introduce any performance overhead, as the conflict between I/O page fault reporting and device releasing is very rare.

AnalysisAI

Use-after-free in the Linux kernel IOMMU VT-d I/O page fault reporting path allows a local low-privileged attacker to access freed kernel memory, with potential for full privilege escalation across confidentiality, integrity, and availability. The race condition occurs when a PCI device is concurrently released from the IOMMU probed-device rbtree between a device lookup and subsequent fault parameter dereference, a window introduced by an efficiency optimization replacing a global list scan with a red-black tree lookup. No public exploit identified at time of analysis, and the EPSS score of 0.22% (12th percentile) signals low real-world exploitation probability despite the high CVSS score.

Technical ContextAI

The vulnerability lives in the Intel VT-d (Virtualization Technology for Directed I/O) IOMMU subsystem of the Linux kernel, specifically the I/O page fault (IOPF) handler. A refactor replaced the global-list PCI device lookup via pci_get_domain_bus_and_slot() with the more efficient device_rbtree_find(), which searches a red-black tree of probed IOMMU devices in O(log n) time. This optimization introduced a time-of-check to time-of-use (TOCTOU) race: the kernel retrieves a device pointer from the rbtree, but the IOMMU subsystem can release and free that device structure before iopf_get_dev_fault_param() dereferences it, resulting in a classic CWE-416 use-after-free. The fix adds a mutex to serialize the IOPF reporting path and the IOMMU device release path, eliminating the race window. The CPE string cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* reflects that all Linux kernel versions containing the affected optimization are in scope.

RemediationAI

Apply the upstream Linux kernel fix by updating to a kernel version incorporating commits 3d39238991e745c5df85785604f037f35d9d1b15 and def054b01a867822254e1dda13d587f5c7a99e2a from https://git.kernel.org/stable/c/. No distribution-specific patched release version number was available in the provided data - monitor your Linux distribution's security advisories (RHSA, USN, DSA, SUSE SA) for kernel updates that backport this fix and apply them promptly. As a compensating control where patching is not immediately feasible, disabling Intel VT-d IOMMU passthrough by setting intel_iommu=off in kernel boot parameters eliminates the affected code path entirely, though this disables IOMMU-based device isolation, potentially impacting security posture in multi-tenant virtualization environments and reducing DMA protection. Alternatively, removing PCI device passthrough configurations from guest VMs prevents IOPF events from reaching the vulnerable handler without fully disabling IOMMU, at the cost of losing direct device assignment functionality.