CVE-2024-26812

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26812", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.180Z", "datePublished": "2024-04-05T08:24:42.627Z", "dateUpdated": "2026-10-15T00:38:39.640Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:33.639Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Create persistent INTx handler\n\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\n\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those. The igate mutex cannot be acquired from the\natomic context of the eventfd wake function. Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\n\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd. Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached exclusively through the VFIO_DEVICE_SET_IRQS ioctl (and config-space writes/irqfd) on an open vfio-pci device file descriptor, requiring local access to /dev/vfio/*. There is no network-facing path to this code.\nAC:L - The NULL-context signal is fully deterministic \u2014 three consecutive SET_IRQS ioctls reach eventfd_signal(NULL) with no timing or layout dependency. For the additional eventfd_ctx use-after-free, the attacker controls both sides of the race (one thread looping trigger replacement, another firing the unmask irqfd and the device's own INTx line).\nPR:L - No capability is checked anywhere on the path; CAP_SYS_RAWIO applies only to no-IOMMU mode. Access is granted by ordinary file permissions on the VFIO device/group node, which is exactly the intended deployment for unprivileged userspace drivers (DPDK/SPDK), libvirt-run QEMU as a non-root user, and containers with delegated /dev/vfio access.\nUI:N - The attacker performs the entire sequence itself via ioctls on a device fd it already holds; no victim action, mount, or file-open is required.\nS:U - The bug is an in-kernel software defect reached through a legitimate ioctl by the process that already owns the device; no IOMMU/DMA boundary is bypassed and no guest-to-host boundary is crossed. Vulnerable and impacted components are both the host kernel.\nC:H - The commit also closes a use-after-free of the eventfd_ctx released by the ioctl path while the asynchronous irqfd inject workqueue is still dereferencing it (the reason synchronize_irq()/vfio_virqfd_flush_thread() were added). Control of the reclaimed slab object yields an arbitrary kernel read primitive via the wait-queue walk.\nI:H - The same use-after-free lets eventfd_signal() write into a reallocated, attacker-sprayed object (ctx->count++) and call a function pointer through wake_up_locked_poll()'s wait-queue traversal, giving a control-flow hijack primitive. On configurations permitting low-address mappings, the NULL dereference itself becomes an attacker-controlled write/call.\nA:H - Any user with access to a VFIO device can reliably oops the kernel in three ioctls via eventfd_signal(NULL) taking a spinlock at a NULL offset, and the use-after-free adds further memory corruption crashes. With panic_on_oops this is a full host panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/pci/vfio_pci_intrs.c"], "versions": [{"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "b18fa894d615c8527e15d96b76c7448800e13899", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "27d40bf72dd9a6600b76ad05859176ea9a1b4897", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "4cb0d7532126d23145329826c38054b4e9a05e7c", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "7d29d4c72c1e196cce6969c98072a272d1a703b3", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "69276a555c740acfbff13fb5769ee9c92e1c828e", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "4c089cefe30924fbe20dd1ee92774ea1f5eca834", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "0e09cf81959d9f12b75ad5c6dd53d237432ed034", "status": "affected", "versionType": "git"}, {"version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "18c198c96a815c962adc2b9b77909eec0be7df4d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/pci/vfio_pci_intrs.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.7.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899"}, {"url": "https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897"}, {"url": "https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c"}, {"url": "https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3"}, {"url": "https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e"}, {"url": "https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834"}, {"url": "https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034"}, {"url": "https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d"}], "title": "vfio/pci: Create persistent INTx handler", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T14:00:34.055358Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:20:45.884Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.527Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:38:39.640Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.527Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:38:39.640Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T14:00:34.055358Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:36.684Z"}}], "cna": {"title": "vfio/pci: Create persistent INTx handler", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached exclusively through the VFIO_DEVICE_SET_IRQS ioctl (and config-space writes/irqfd) on an open vfio-pci device file descriptor, requiring local access to /dev/vfio/*. There is no network-facing path to this code.\nAC:L - The NULL-context signal is fully deterministic \u2014 three consecutive SET_IRQS ioctls reach eventfd_signal(NULL) with no timing or layout dependency. For the additional eventfd_ctx use-after-free, the attacker controls both sides of the race (one thread looping trigger replacement, another firing the unmask irqfd and the device's own INTx line).\nPR:L - No capability is checked anywhere on the path; CAP_SYS_RAWIO applies only to no-IOMMU mode. Access is granted by ordinary file permissions on the VFIO device/group node, which is exactly the intended deployment for unprivileged userspace drivers (DPDK/SPDK), libvirt-run QEMU as a non-root user, and containers with delegated /dev/vfio access.\nUI:N - The attacker performs the entire sequence itself via ioctls on a device fd it already holds; no victim action, mount, or file-open is required.\nS:U - The bug is an in-kernel software defect reached through a legitimate ioctl by the process that already owns the device; no IOMMU/DMA boundary is bypassed and no guest-to-host boundary is crossed. Vulnerable and impacted components are both the host kernel.\nC:H - The commit also closes a use-after-free of the eventfd_ctx released by the ioctl path while the asynchronous irqfd inject workqueue is still dereferencing it (the reason synchronize_irq()/vfio_virqfd_flush_thread() were added). Control of the reclaimed slab object yields an arbitrary kernel read primitive via the wait-queue walk.\nI:H - The same use-after-free lets eventfd_signal() write into a reallocated, attacker-sprayed object (ctx->count++) and call a function pointer through wake_up_locked_poll()'s wait-queue traversal, giving a control-flow hijack primitive. On configurations permitting low-address mappings, the NULL dereference itself becomes an attacker-controlled write/call.\nA:H - Any user with access to a VFIO device can reliably oops the kernel in three ioctls via eventfd_signal(NULL) taking a spinlock at a NULL offset, and the use-after-free adds further memory corruption crashes. With panic_on_oops this is a full host panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "b18fa894d615c8527e15d96b76c7448800e13899", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "27d40bf72dd9a6600b76ad05859176ea9a1b4897", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "4cb0d7532126d23145329826c38054b4e9a05e7c", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "7d29d4c72c1e196cce6969c98072a272d1a703b3", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "69276a555c740acfbff13fb5769ee9c92e1c828e", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "4c089cefe30924fbe20dd1ee92774ea1f5eca834", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "0e09cf81959d9f12b75ad5c6dd53d237432ed034", "versionType": "git"}, {"status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "lessThan": "18c198c96a815c962adc2b9b77909eec0be7df4d", "versionType": "git"}], "programFiles": ["drivers/vfio/pci/vfio_pci_intrs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"status": "unaffected", "version": "0", "lessThan": "3.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.154", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.84", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.24", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vfio/pci/vfio_pci_intrs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899"}, {"url": "https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897"}, {"url": "https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c"}, {"url": "https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3"}, {"url": "https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e"}, {"url": "https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834"}, {"url": "https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034"}, {"url": "https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Create persistent INTx handler\n\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\n\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those. The igate mutex cannot be acquired from the\natomic context of the eventfd wake function. Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\n\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd. Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.154", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.84", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.24", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.12", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.3", "versionStartIncluding": "3.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "3.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:33.639Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26812", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:38:39.640Z", "dateReserved": "2024-02-19T14:20:24.180Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-05T08:24:42.627Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vfio/pci/vfio_pci_intrs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b18fa894d615c8527e15d96b76c7448800e13899", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "27d40bf72dd9a6600b76ad05859176ea9a1b4897", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "4cb0d7532126d23145329826c38054b4e9a05e7c", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "7d29d4c72c1e196cce6969c98072a272d1a703b3", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "69276a555c740acfbff13fb5769ee9c92e1c828e", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "4c089cefe30924fbe20dd1ee92774ea1f5eca834", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "0e09cf81959d9f12b75ad5c6dd53d237432ed034", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}, {"lessThan": "18c198c96a815c962adc2b9b77909eec0be7df4d", "status": "affected", "version": "89e1f7d4c66d85f42c3d52ea3866eb10cadf6153", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vfio/pci/vfio_pci_intrs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"lessThan": "3.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADFF9FF1-413F-4606-9C95-7A20215ACD86", "versionEndExcluding": "6.1.84", "versionStartIncluding": "3.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8018C1D0-0A5F-48D0-BC72-A2B33FDDA693", "versionEndExcluding": "6.6.24", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53", "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02", "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Create persistent INTx handler\n\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\n\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those. The igate mutex cannot be acquired from the\natomic context of the eventfd wake function. Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\n\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd. Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vfio/pci: crear un controlador INTx persistente Existe una vulnerabilidad donde se puede desconfigurar el eventfd para la se\u00f1alizaci\u00f3n INTx, lo que anula el registro del controlador IRQ pero a\u00fan permite que los eventfds se se\u00f1alen con un contexto NULL a trav\u00e9s de el SET_IRQS ioctl o mediante unmask irqfd si la interrupci\u00f3n del dispositivo est\u00e1 pendiente. Idealmente, esto podr\u00eda solucionarse con alg\u00fan bloqueo adicional; el igate mutex serializa los accesos al espacio ioctl y de configuraci\u00f3n, y el controlador de interrupciones no est\u00e1 registrado en relaci\u00f3n con el disparador, pero la ruta irqfd se ejecuta de forma asincr\u00f3nica con respecto a ellos. El mutex igate no se puede adquirir desde el contexto at\u00f3mico de la funci\u00f3n de activaci\u00f3n eventfd. Deshabilitar el irqfd en relaci\u00f3n con el registro de eventfd es potencialmente incompatible con el espacio de usuario existente. Como resultado, la soluci\u00f3n implementada aqu\u00ed mueve la configuraci\u00f3n del controlador de interrupciones INTx para rastrear la vida \u00fatil del objeto de contexto INTx y la configuraci\u00f3n irq_type, en lugar del registro de un evento desencadenante particular. Se agrega sincronizaci\u00f3n entre la ruta ioctl y el contenedor eventfd_signal() de modo que el disparador eventfd se pueda actualizar din\u00e1micamente en relaci\u00f3n con las interrupciones en curso o las devoluciones de llamada irqfd."}], "id": "CVE-2024-26812", "lastModified": "2026-10-15T01:17:24.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26812", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-04-05T14:00:34.055358Z", "version": "2.0.3"}}]}, "published": "2024-04-05T09:15:09.283", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: vfio/pci: Create persistent INTx handler", "id": "2273650", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273650"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvfio/pci: Create persistent INTx handler\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those. The igate mutex cannot be acquired from the\natomic context of the eventfd wake function. Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd. Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.", "An interrupt handling flaw was found in the Linux kernel\u2019s PCI core device driver. This flaw allows a local user to potentially crash the system."], "name": "CVE-2024-26812", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26812\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26812\nhttps://lore.kernel.org/linux-cve-announce/2024040550-CVE-2024-26812-1e08@gregkh/T"], "threat_severity": "Low"}

{}