Review reviewHigh

CVE-2024-35843

Linux Linux, linux_kernel, linux kernel

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with device_rbtree_find() to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the prob...

CVSS: 8.8
EPSS: 0.23%
CISA KEV: Not listed
Published: 2024.05.18

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.23%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux_kernel, linux kernel
Affected versions: >= 06f4b8d09dbabec631ed7b033f5d5413d86c7134 < 3d39238991e745c5df85785604f037f35d9d1b15, >= 06f4b8d09dbabec631ed7b033f5d5413d86c7134 < def054b01a867822254e1dda13d587f5c7a99e2a, >= 6.1, >= 1da177e4c3f4 < 3d39238991e7, >= 1da177e4c3f4 < def054b01a86, < 6.8.2
Fixed versions: 6.8.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux_kernel, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-416