LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26814: vfio/fsl-mc: Block calling interrupt handler without trigger

In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling interrupt handler without trigger The eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is initially NULL and may become NULL if the user sets the trigger eventfd to -1. The interrupt handler itself is guaranteed that trigger is always valid between request_irq() and free_irq(), but the loopback testing mechanisms to invoke the handler function need to test the trigger. The triggering and setting ioctl paths both make use of igate and are therefore mutually exclusive. The vfio-fsl-mc driver does not make use of irqfds, nor does it support any sort of masking operations, therefore unlike vfio-pci and vfio-platform, the flow can remain essentially unchanged.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver bug in vfio/fsl-mc. A user-controlled testing path could call an interrupt handler when its trigger pointer is absent, plausibly causing a kernel fault. Business impact is most relevant to systems using VFIO with Freescale/NXP Management Complex hardware, not ordinary Linux hosts without that driver path.

Executive priority

Treat as targeted maintenance unless your environment uses fsl-mc VFIO devices. Prioritize patching in virtualization, embedded, or appliance fleets where this driver is present and device access is delegated.

Technical view

The vfio_fsl_mc_irq trigger eventfd pointer can be NULL initially or after userspace sets the trigger eventfd to -1. Normal IRQ lifetime protects the handler, but loopback testing paths invoking the handler must check trigger first. Stable kernel commits add that guard for affected Linux branches.

Likely exposure

Exposure appears limited to Linux systems with the vfio-fsl-mc driver and accessible fsl-mc VFIO devices. The bundle does not identify affected distributions beyond a Debian LTS advisory, nor does it provide CVSS, CWE, or exploitability details.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. A realistic scenario would require local or delegated access to the relevant VFIO device interface. Evidence supports a stability or denial-of-service concern more than remote compromise.

Researcher notes

The key issue is a missing NULL trigger check in a loopback test path, not the normal request_irq/free_irq handler lifetime. The bundle lacks CVSS and detailed impact analysis, so conclusions beyond local kernel fault risk should remain cautious.

Mitigation direction

  • Upgrade to a kernel containing the listed stable vfio/fsl-mc fixes.
  • Follow distribution guidance, including the referenced Debian LTS advisory where applicable.
  • Restrict VFIO device access to trusted users and workloads.
  • Check vendor kernel advisories for exact fixed package versions.

Validation and detection

  • Inventory systems using fsl-mc hardware or the vfio-fsl-mc driver.
  • Confirm running kernel versions against vendor fixed releases.
  • Review whether untrusted users or guests can access relevant VFIO devices.
  • Verify deployed kernels include one of the referenced stable commits.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcc0ee20bd96971c10eba9a83ecf1c0733078a083, cc0ee20bd96971c10eba9a83ecf1c0733078a083, cc0ee20bd96971c10eba9a83ecf1c0733078a083, cc0ee20bd96971c10eba9a83ecf1c0733078a083, cc0ee20bd96971c10eba9a83ecf1c0733078a083, cc0ee20bd96971c10eba9a83ecf1c0733078a083, cc0ee20bd96971c10eba9a83ecf1c0733078a083unaffected
LinuxLinux5.10, 0, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.