5.5

CVE-2024-27437: debian debian_linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-27437DEBIAN-CVE-2024-27437
Published 05-04-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-27437 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 36 · Related 32
DLA-3842-1DSA-5658-1DSA-5681-1RHSA-2024:9315SUSE-SU-2024:2892-1SUSE-SU-2024:2894-1

Timeline

  1. 05-04-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ Currently for devices requiring masking at the irqchip for INTx, ie. devices without DisINTx support, the IRQ is enabled in request_irq() and subsequently disabled as necessary to align with the masked status flag. This presents a window where the interrupt could fire between these events, resulting in the IRQ incrementing the disable depth twice. This would be unrecoverable for a user since the masked flag prevents nested enables through vfio. Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx is never auto-enabled, then unmask as required.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu117 products
  • linuxAll versions (No fix recorded) | < 4.4.0-259.293 | < 4.15.0-229.241 | < 5.4.0-189.209 | < 5.15.0-116.126 | < 6.8.0-35.35
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1136.142 | < 4.4.0-1174.189 | < 4.15.0-1173.186 | < 5.4.0-1128.138 | < 5.15.0-1065.71 | < 6.8.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < 26389925d6c2126fb777821a0a983adca7ee6351 | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < 561d5e1998d58b54ce2bbbb3e843b669aa0b3db5 | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < b7a2f0955ffceffadfe098b40b50307431f45438 | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < 139dfcc4d723ab13469881200c7d80f49d776060 | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < 2a4a666c45107206605b7b5bc20545f8aabc4fa2 | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < 3b3491ad0f80d913e7d255941d4470f4a4d9bfda | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < bf0bc84a20e6109ab07d5dc072067bd01eb931ec | ≥ 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153, < fe9a7082684eb059b925c535682e68c34d487d43 | 3.6
  • linux_kernel≥ 3.6, < 6.1.84 | ≥ 6.2, < 6.6.24 | ≥ 6.7, < 6.7.12 | ≥ 6.8, < 6.8.3 | ≥ 6.8.4, ≤ 6.8.12

3 vendors · 121 products

References

35 links
Show all 35 references