LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26810: vfio/pci: Lock external INTx masking ops

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outside of the core interrupt code. In particular, irq_type is updated holding igate, therefore testing is_intx() requires holding igate. For example clearing DisINTx from config space can otherwise race changes of the interrupt configuration. This aligns interfaces which may trigger the INTx eventfd into two camps, one side serialized by igate and the other only enabled while INTx is configured. A subsequent patch introduces synchronization for the latter flows.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2024-26810 is a Linux kernel race condition in VFIO PCI interrupt handling. Concurrent changes through PCI configuration space and an ioctl may leave interrupt state improperly synchronized. The supplied CVSS score is 7.8, reflecting potentially serious confidentiality, integrity, and availability impact, although the sources do not describe a demonstrated attack or specific failure outcome.

Executive priority

Treat this as a high-priority kernel maintenance issue for virtualization, passthrough, and device-assignment hosts. Patch those systems promptly after vendor validation. General Linux systems without reachable VFIO PCI workflows are lower priority, but should still follow normal supported-kernel updates. There is no supplied evidence requiring emergency incident response for active exploitation.

Technical view

External INTx masking through the DisINTx configuration bit could race with VFIO interrupt reconfiguration through ioctl. The irq_type state and is_intx() checks were not consistently protected by the igate lock. Linux stable commits add locking wrappers for operations outside the core interrupt path, aligning synchronization around paths that may trigger the INTx eventfd.

Likely exposure

Exposure is most likely on affected Linux kernels where vfio-pci and legacy INTx interrupt handling are actively used, such as certain device-passthrough configurations. The CVSS vector indicates local access and low privileges, but actual reachability depends on access to the relevant VFIO device and interfaces. The supplied version data is insufficiently precise for package-level conclusions.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. Exploitation would require local interaction with the affected VFIO PCI interrupt paths and winning a race. The sources do not establish reliability, observed attacks, or the exact security consequence of successfully triggering the race.

Researcher notes

The core defect is inconsistent igate serialization around irq_type and is_intx() during external DisINTx masking. Review backports for the locking wrappers and correct lock coverage, not merely a matching version string. A subsequent synchronization patch is mentioned, so assess neighboring upstream changes. The bundle supplies no CWE, reproducer, crash signature, or proven exploitation primitive.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable Linux stable fix commit.
  • Consult distribution or appliance advisories to map packaged kernel versions to the listed fixes.
  • Prioritize hosts using VFIO PCI passthrough, especially configurations relying on INTx interrupts.
  • Restrict untrusted access to VFIO devices and device-passthrough management interfaces until patched.

Validation and detection

  • Inventory kernel versions and identify systems loading or using vfio-pci.
  • Determine whether assigned PCI devices use legacy INTx rather than MSI or MSI-X.
  • Compare vendor kernel changelogs against CVE-2024-26810 and the referenced stable commits.
  • After updating, verify the running kernel includes the vendor backport and reboot completed successfully.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26810 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
3ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H0.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-26810Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153unaffected
LinuxLinux3.6, 0, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.