CVE-2024-27066: virtio: packed: fix unmap leak for indirect desc table

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-01 · updated 2026-08-04
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: virtio: packed: fix unmap leak for indirect desc table When use_dma_api and premapped are true, then the do_unmap is false. Because the do_unmap is false, vring_unmap_extra_packed is not called by detach_buf_packed. if (unlikely(vq->do_unmap)) { curr = id; for (i = 0; i < state->num; i++) { vring_unmap_extra_packed(vq, &vq->packed.desc_extra[curr]); curr = vq->packed.desc_extra[curr].next; } } So the indirect desc table is not unmapped. This causes the unmap leak. So here, we check vq->use_dma_api instead. Synchronously, dma info is updated based on use_dma_api judgment This bug does not occur, because no driver use the premapped with indirect.

Affected products

Linux kernel: from 6.6 before 6.6.23; from 6.7 before 6.7.11; from 6.8 before 6.8.2 — fixed in 6.6.23, 6.7.11, 6.8.2

How to fix

Upgrade to a fixed version: Linux kernel 6.6.23, 6.7.11, 6.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-27066 or the next vulnerability affects your stack