CVE-2024-26976

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs is being destroyed. KVM must ensure that none of its workqueue callbacks is running when the last reference to the KVM _module_ is put. Gifting a reference to the associated VM prevents the workqueue callback from dereferencing freed vCPU/VM memory, but does not prevent the KVM module from being unloaded before the callback completes....

Affected product and versions

Product

Linux Linux, linux_kernel, linux kernel

Affected versions

>= af585b921e5d1e919947c4b1164b59507fe7cd7b < ab2c2f5d9576112ad22cfd3798071cb74693b1f5, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < 82e25cc1c2e93c3023da98be282322fc08b61ffb, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < f8730d6335e5f43d09151fca1f0f41922209a264, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < 83d3c5e309611ef593e2fcb78444fc8ceedf9bac, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < b54478d20375874aeee257744dedfd3e413432ff, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < a75afe480d4349c524d9c659b1a5a544dbc39a98, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < 4f3a3bce428fb439c66a578adc447afce7b4a750, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < caa9af2e27c275e089d702cfbaaece3b42bca31b, >= af585b921e5d1e919947c4b1164b59507fe7cd7b < 3d75b8aa5c29058a512db29da7cbee8052724157, >= 2.6.38, >= af585b921e5d < ab2c2f5d9576, >= af585b921e5d < 82e25cc1c2e9, >= af585b921e5d < 8730d6335e5, >= af585b921e5d < 83d3c5e30961, >= af585b921e5d < b54478d20375, >= af585b921e5d < a75afe480d43, >= af585b921e5d < 4f3a3bce428f, >= af585b921e5d < caa9af2e27c2, >= af585b921e5d < 3d75b8aa5c29, >= 2.6.38 < 4.19.312

Fixed versions

4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-400