CVE-2024-26814

vfio/fsl-mc: Block calling interrupt handler without trigger

MEDIUM
5.5
CVSS Score
Published: April 5, 2024 at 08:24 AM UTC
Updated: June 17, 2026 at 07:18 AM UTC
2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling interrupt handler without trigger The eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is initially NULL and may become NULL if the user sets the trigger eventfd to -1. The interrupt handler itself is guaranteed that trigger is always valid between request_irq() and free_irq(), but the loopback testing mechanisms to invoke the handler function need to test the trigger. The triggering and setting ioctl paths both make use of igate and are therefore mutually exclusive. The vfio-fsl-mc driver does not make use of irqfds, nor does it support any sort of masking operations, therefore unlike vfio-pci and vfio-platform, the flow can remain essentially unchanged.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.10 ≤ v < 5.10.2155.10 ≤ v < 5.15.1545.10 ≤ v < 6.1.845.10 ≤ v < 6.6.245.10 ≤ v < 6.7.125.10 ≤ v < 6.8.35.10 ≤ v < 6.96.2 ≤ v < 6.6.246.7 ≤ v < 6.7.126.8 ≤ v < 6.8.36.8.4 ≤ v ≤ 6.8.125.10cc0ee20bd96971c10eba9a83ecf1c0733078a083
Vendor states this is fixed in 083e750c9f5f4c3bf61161330fb84d7c8e8bb417 (fixed)
Vendor states this is fixed in 250219c6a556f8c69c5910fca05a59037e24147d (fixed)
Vendor states this is fixed in 6ec0d88166dac43f29e96801c0927d514f17add9 (fixed)
Vendor states this is fixed in 7447d911af699a15f8d050dfcb7c680a86f87012 (fixed)
Vendor states this is fixed in a563fc18583ca4f42e2fdd0c70c7c618288e7ede (fixed)
Vendor states this is fixed in de87511fb0404d23b6da5f4660383b6ed095e28d (fixed)
Vendor states this is fixed in ee0bd4ad780dfbb60355b99f25063357ab488267 (fixed)
Vendor states this is fixed in 5.10 (unaffected)
Vendor states this is fixed in 5.10.215 (unaffected)
Vendor states this is fixed in 5.15.154 (unaffected)
Vendor states this is fixed in 6.1.84 (unaffected)
Vendor states this is fixed in 6.6.24 (unaffected)
Vendor states this is fixed in 6.7.12 (unaffected)
Vendor states this is fixed in 6.8.3 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)

References (8)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/083e750c9f5f4c3bf61161330fb84d7c8e8bb417
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/250219c6a556f8c69c5910fca05a59037e24147d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6ec0d88166dac43f29e96801c0927d514f17add9
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7447d911af699a15f8d050dfcb7c680a86f87012
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a563fc18583ca4f42e2fdd0c70c7c618288e7ede
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/de87511fb0404d23b6da5f4660383b6ed095e28d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ee0bd4ad780dfbb60355b99f25063357ab488267
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card