Linux Kernel CVE-2024-35843

Exploitation requires the target system to have Intel VT-d IOMMU enabled (kernel boot parameter intel_iommu=on or platform default) and at least one PCI device configured for I/O page fault handling - conditions most commonly present on virtualization hosts using PCI passthrough to guest VMs. The attacker must hold a local authenticated low-privilege account (PR:L per CVSS vector) on the host. Crucially, exploitation depends on winning a race condition between two concurrent kernel operations: a device removal from the IOMMU probed-device rbtree and an IOPF interrupt from the same device - a narrow and non-deterministic window that limits reliable exploitation. Systems with IOMMU disabled, systems not using PCI passthrough or IOPF features, and guest VMs (as opposed to the hypervisor host) are not exposed to this code path.

The NVD-assigned CVSS 3.1 score of 8.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a local, low-privilege, scope-changing kernel attack - characteristic of a kernel privilege escalation primitive. The Scope:Changed metric indicates that successful exploitation transcends the attacker's original privilege boundary, reaching kernel space. However, the AC:L rating appears generous: the defect is a race condition that requires winning a narrow timing window between a concurrent device release and an IOPF interrupt, which in practice demands precise coordination and would more accurately merit AC:H. The EPSS score of 0.22% at the 12th percentile strongly contrasts with the CVSS severity, reflecting that this class of kernel race condition is difficult to exploit reliably without deep kernel internals expertise. The vulnerability is not listed in CISA KEV, and no POC has been identified at time of analysis. The primary risk population is virtualization hosts and cloud infrastructure nodes with Intel VT-d IOMMU enabled and PCI passthrough actively configured - not general-purpose Linux endpoints.

A local attacker with low-privileged shell access on a Linux virtualization host with Intel VT-d IOMMU enabled crafts a scenario where a passthrough PCI device generates an I/O page fault interrupt precisely while the IOMMU subsystem concurrently removes that device from the probed-device tree. If the race window is won, the kernel dereferences a freed device structure in iopf_get_dev_fault_param(), potentially corrupting kernel heap metadata and providing a primitive for privilege escalation to root. No public exploit code for this specific race condition has been identified at time of analysis, and reliable exploitation requires advanced kernel internals knowledge and controlled timing of concurrent kernel operations.