In the Linux kernel, the following vulnerability has been resolved:
vhost_vdpa: assign irq bypass producer token correctly
We used to call irq_bypass_unregister_producer() in
vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the
token pointer is still valid or not.
Actually, we use the eventfd_ctx as the token so the life cycle of the
token should be bound to the VHOST_SET_VRING_CALL instead of
vhost_vdpa_setup_vq_irq() which could be called by set_status().
Fixing this by setting up irq bypass producer's token when handling
VHOST_SET_VRING_CALL and un-registering the producer before calling
vhost_vring_ioctl() to prevent a possible use after free as eventfd
could have been released in vhost_vring_ioctl(). And such registering
and unregistering will only be done if DRIVER_OK is set.
Security readout for executives and security teams
Plain-English summary
A Linux vhost-vdpa flaw can leave the kernel using a released event-notification object. On affected virtualization hosts, a local low-privileged attacker could potentially crash the system or compromise data and kernel integrity. Exposure depends on whether vhost-vdpa is present, used, and accessible.
Executive priority
Treat this as a high-priority host-hardening issue for virtualization infrastructure using vhost-vdpa, especially where untrusted local workloads operate. Expedite vendor-supported kernel updates. Lower the priority for systems where the component is absent or inaccessible, while documenting that conclusion.
Technical view
The IRQ-bypass producer used an eventfd_ctx token whose lifetime was incorrectly tied to vhost_vdpa_setup_vq_irq(). Because set_status() can invoke that path after the eventfd is released, a possible use-after-free exists. The fix binds registration to VHOST_SET_VRING_CALL and unregisters before vhost_vring_ioctl(), when DRIVER_OK is set.
Likely exposure
Relevant Linux systems using vhost-vdpa are the likely exposure. The bundle lists affected version points from 5.9 through 6.12, but distribution backports make version-only assessment unreliable. Systems without vhost-vdpa use or without local access to the relevant interface have lower practical exposure.
Exploitation context
The CVSS 3.1 score is 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The source assigns no CWE, although the kernel description identifies a possible use-after-free involving eventfd_ctx token lifetime. The record supplies multiple stable-branch commits but no reproduction details, exploitation evidence, or precise distribution package mapping. Researchers should distinguish theoretical CVSS impact from demonstrated exploitability.
Mitigation direction
Install a vendor kernel containing the appropriate stable fix for CVE-2024-47748.
Consult distribution guidance because fixed code may be backported without changing the upstream version meaningfully.
Restrict local access to vhost-vdpa interfaces until affected hosts are updated.
Disable unused vhost-vdpa functionality where operationally safe and supported.
Validation and detection
Inventory kernels on hosts providing vhost-vdpa-backed virtualization.
Confirm whether the vhost_vdpa module or functionality is enabled and actively used.
Verify installed packages include the vendor backport or referenced stable-kernel fix.
Reboot into the updated kernel and confirm the running version.
Review vendor advisories rather than relying solely on upstream version numbers.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
description · low confidence lookup
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.