In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence target device to be sent and deadly loop to retry that request after ITE fault triggered in interrupt context.
That would cause following continuous hard lockup warning and system hang
[ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down [ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present [ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144 [ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822623] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1 0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822626] FS: 0000000000000000(0000) GS:ffffa237ae400000(0000) knlGS:0000000000000000 [ 4223.822627] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0 [ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 4223.822628] PKRU: 55555554 [ 4223.822628] Call Trace: [ 4223.822628] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822628] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822629] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822629] intel_iommu_release_device+0x1f/0x30 [ 4223.822629] iommu_release_device+0x33/0x60 [ 4223.822629] iommu_bus_notifier+0x7f/0x90 [ 4223.822630] blocking_notifier_call_chain+0x60/0x90 [ 4223.822630] device_del+0x2e5/0x420 [ 4223.822630] pci_remove_bus_device+0x70/0x110 [ 4223.822630] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822631] pciehp_disable_slot+0x6b/0x100 [ 4223.822631] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822631] pciehp_ist+0x176/0x180 [ 4223.822631] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822632] irq_thread_fn+0x19/0x50 [ 4223.822632] irq_thread+0x104/0x190 [ 4223.822632] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822632] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822633] kthread+0x114/0x130 [ 4223.822633] ? __kthread_cancel_work+0x40/0x40 [ 4223.822633] ret_from_fork+0x1f/0x30 [ 4223.822633] Kernel panic - not syncing: Hard LOCKUP [ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822634] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822634] Call Trace: [ 4223.822634] <NMI> [ 4223.822635] dump_stack+0x6d/0x88 [ 4223.822635] panic+0x101/0x2d0 [ 4223.822635] ? ret_from_fork+0x11/0x30 [ 4223.822635] nmi_panic.cold.14+0xc/0xc [ 4223.822636] watchdog_overflow_callback.cold.8+0x6d/0x81 [ 4223.822636] __perf_event_overflow+0x4f/0xf0 [ 4223.822636] handle_pmi_common ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.153-100.162Upgrade perfUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.214-202.855Upgrade kernelUpgrade python-perfUpgrade kernel-develUpgrade kernel-toolsUpgrade bpftool | Dec 20, 2024 | Apr 17, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade perfUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.84-99.169Upgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade bpftool | Feb 17, 2025 | Apr 17, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 9, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftool | Nov 5, 2024 | Apr 17, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 17, 2024 |
| Suse | — | Upgrade kernel-default-optionalUpgrade dtb-amazonUpgrade kernel-debugUpgrade kernel-rt_debug-develUpgrade kernel-default-vdsoUpgrade kernel-64kb-extraUpgrade kernel-default-base-rebuildUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade dlm-kmp-64kbUpgrade kernel-sourceUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade kernel-default-develUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade dtb-qcomUpgrade gfs2-kmp-defaultUpgrade dtb-lgUpgrade kernel-debug-vdsoUpgrade kernel-source-azureUpgrade dtb-xilinxUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade dtb-allwinnerUpgrade gfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-devel-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-freescaleUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-source-vanillaUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade kselftests-kmp-azureUpgrade kernel-64kbUpgrade kernel-64kb-develUpgrade kernel-rtUpgrade dtb-alteraUpgrade kernel-azureUpgrade kernel-default-livepatchUpgrade kernel-devel-rtUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade dtb-sprdUpgrade dtb-armUpgrade kernel-macrosUpgrade kernel-symsUpgrade dtb-socionextUpgrade dtb-hisiliconUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-azure-develUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade dtb-marvellUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade dtb-apmUpgrade dtb-amdUpgrade cluster-md-kmp-defaultUpgrade dtb-renesasUpgrade kernel-source-rtUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade dlm-kmp-azureUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade kernel-debug-livepatch-devel | May 15, 2024 | Apr 17, 2024 |
| Ubuntu | — | Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-oemUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-20.04cUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-200-genericUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-raspi2Upgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeopUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-virtualUpgrade linux-image-intelUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.4.0-1044-iotUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-gkeUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-nvidiaUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1135-awsUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-oem-20.04Upgrade linux-image-bluefieldUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-genericUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-5.4.0-1139-azureUpgrade linux-image-ibmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-aws-lts-20.04Upgrade linux-image-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-6.8.0-1006-oracle-64k | Jul 1, 2024 | Apr 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub