CVE-2024-26691 KVM: arm64: Fix circular locking dependency
A circular locking dependency in KVM arm64 can cause a deadlock, leading to denial of service for virtual machines.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26691?
CVE-2024-26691 is a medium-severity vulnerability in Linux kernel, published on 3 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix circular locking dependency
The rule inside kvm enforces that the vcpu->mutex is taken *inside* kvm->lock. The rule is violated by the pkvm_create_hyp_vm() which acquires the kvm->lock while already holding the vcpu->mutex lock from kvm_vcpu_ioctl(). Avoid the circular locking dependency altogether by protecting the hyp vm handle with the config_lock, much like we already do for other forms of VM-scoped data.
Weakness: CWE-667
Which versions are affected by CVE-2024-26691?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26691?
Apply the vendor's patch.
Is CVE-2024-26691 being exploited?
There is no known exploitation of CVE-2024-26691 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26691, DEBIAN-CVE-2024-26691, GHSA-p9j3-r5pw-645f, ROOT-OS-DEBIAN-11-CVE-2024-26691, ROOT-OS-DEBIAN-12-CVE-2024-26691, ROOT-OS-UBUNTU-2204-CVE-2024-26691 and 1 more.