The Linux kernel's vfio/pci driver had a vulnerability involving the disable_idle_d3 module parameter, which was initially writable and manipulated device power states directly without reference counting. Later changes nullified the writable aspect at module init, but loading or reloading the module with different parameter values could alter global states affecting devices bound to vfio-pci variant drivers. This could cause inconsistent power management behavior. The issue was fixed in Linux kernel versions released for Ubuntu 24.04 LTS HWE and OEM kernels. The vendor advisory details comprehensive kernel updates addressing this and other vulnerabilities across multiple subsystems. The fix involves upgrading to the specified patched kernel versions and rebooting.

If unpatched, the vulnerability could lead to inconsistent device power state management in the vfio/pci driver, potentially affecting device stability or security. The vendor advisory also mentions other kernel vulnerabilities that could allow local privilege escalation or bypass of memory protections, but no specific exploit in the wild is known for this vfio/pci issue. The overall impact is rated medium severity by the vendor.

A fix is available and included in updated Linux kernel packages for Ubuntu 24.04 LTS HWE and OEM kernels. Users should update their systems to the specified patched kernel versions and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of any third-party kernel modules are required after updating. No additional mitigation steps are indicated by the vendor advisory.