CVE-2024-26990 (GCVE-0-2024-26990)
Vulnerability from cvelistv5
Published
2024-05-01 05:27
Modified
2026-08-05 11:28
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status Check kvm_mmu_page_ad_need_write_protect() when deciding whether to write-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU accounts for any role-specific reasons for disabling D-bit dirty logging. Specifically, TDP MMU SPTEs must be write-protected when the TDP MMU is being used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled. KVM always disables PML when running L2, even when L1 and L2 GPAs are in the some domain, so failing to write-protect TDP MMU SPTEs will cause writes made by L2 to not be reflected in the dirty log. [sean: massage shortlog and changelog, tweak ternary op formatting]
References
Impacted products
Vendor Product Version
Linux Linux Version: 5982a5392663b30f57ee90b0372c19a7e9cb655a
Version: 5982a5392663b30f57ee90b0372c19a7e9cb655a
Version: 5982a5392663b30f57ee90b0372c19a7e9cb655a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T20:04:24.835393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T20:04:34.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:15:35.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdf811a937471af2d1facdf8ae80e5e68096f1ed",
              "status": "affected",
              "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a",
              "versionType": "git"
            },
            {
              "lessThan": "e20bff0f1b2de9cfe303dd35ff46470104a87404",
              "status": "affected",
              "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a",
              "versionType": "git"
            },
            {
              "lessThan": "2673dfb591a359c75080dd5af3da484b89320d22",
              "status": "affected",
              "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\n\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\naccounts for any role-specific reasons for disabling D-bit dirty logging.\n\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\nwrites made by L2 to not be reflected in the dirty log.\n\n[sean: massage shortlog and changelog, tweak ternary op formatting]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering the flaw requires executing code in a VM on the affected host \u2014 VMLAUNCHing an L2 with EPT disabled via /dev/kvm \u2014 which is local code execution on the vulnerable component. No host-side network protocol handler reaches the TDP MMU dirty-logging paths.\nAC:L - The miss is unconditional and deterministic: any SPTE created under the guest_mode TDP root is WRPROT_ONLY, and the clearing path always chose the D-bit instead, with no race, timing window, or memory layout the attacker cannot influence. The guest chooses to run an L2 without EPT and can keep it running indefinitely, and dirty logging is a routine, recurring host operation (migration, dirty ring, framebuffer); syzkaller reproduced it from an ordinary local process.\nPR:L - The attacker only needs the ability to create and run a VM \u2014 /dev/kvm access via the kvm group, or simply being the tenant of a guest on a virtualization host \u2014 which is a low-privileged position on the vulnerable component. No host root, CAP_SYS_ADMIN, or module parameter change is required since nested VMX, PML, and the TDP MMU are all enabled by default.\nUI:N - Dirty logging is turned on by the orchestrator or device model automatically (maintenance/rebalancing live migrations, dirty-ring checkpointing, VGA framebuffer tracking) with no human in the loop. Once logging is active the guest\u0027s own L2 execution loses the writes with no cooperation from any other user.\nS:C - The defect is in the host kernel\u0027s KVM module, but the damage is realized in a different security authority \u2014 the guest VM\u0027s memory, governed by the guest OS \u2014 and lets guest activity escape the host hypervisor\u0027s dirty-tracking ABI entirely. A low-privileged guest context causes corruption of guest-kernel and other-guest-process memory it could never write directly, crossing the host/guest boundary.\nC:H - Every page written by L2 during the logging window is omitted from the dirty bitmap, so the migrated VM retains stale contents for those pages \u2014 including guest page tables whose rolled-back PTEs still map physical frames since reassigned to other processes or the guest kernel, yielding an arbitrary-read window across intra-guest security boundaries. It also silently defeats any host-side introspection, forensics, or checkpoint mechanism that relies on KVM dirty tracking to observe guest writes.\nI:H - Writes the guest architecturally committed are silently reverted on the destination VM; for paging structures and kernel data this is a rollback of mapping and permission state, credential structures, reference counts, and lock words, amounting to an arbitrary-write primitive over memory belonging to other processes and the kernel inside the VM. Unlike the emulated-atomic variant of this bug, the entire write stream of L2 is dropped, not a narrow subset.\nA:H - A VM resuming with inconsistent memory \u2014 stale page tables or reverted kernel structures \u2014 panics, hangs, or corrupts its filesystem, taking down the whole VM and every workload on it, and the loss is unrecoverable once the source VM is discarded. Additionally the guest-triggerable KVM_MMU_WARN_ON in clear_dirty_gfn_range()/clear_dirty_pt_masked() (the syzbot-reported symptom) produces a kernel WARN that is fatal on hosts running panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:51.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404"
        },
        {
          "url": "https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22"
        }
      ],
      "title": "KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26990",
    "datePublished": "2024-05-01T05:27:48.810Z",
    "dateReserved": "2024-02-19T14:20:24.205Z",
    "dateUpdated": "2026-08-05T11:28:51.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:15:35.930Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26990\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-14T20:04:24.835393Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-14T20:04:31.930Z\"}}], \"cna\": {\"title\": \"KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggering the flaw requires executing code in a VM on the affected host \\u2014 VMLAUNCHing an L2 with EPT disabled via /dev/kvm \\u2014 which is local code execution on the vulnerable component. No host-side network protocol handler reaches the TDP MMU dirty-logging paths.\\nAC:L - The miss is unconditional and deterministic: any SPTE created under the guest_mode TDP root is WRPROT_ONLY, and the clearing path always chose the D-bit instead, with no race, timing window, or memory layout the attacker cannot influence. The guest chooses to run an L2 without EPT and can keep it running indefinitely, and dirty logging is a routine, recurring host operation (migration, dirty ring, framebuffer); syzkaller reproduced it from an ordinary local process.\\nPR:L - The attacker only needs the ability to create and run a VM \\u2014 /dev/kvm access via the kvm group, or simply being the tenant of a guest on a virtualization host \\u2014 which is a low-privileged position on the vulnerable component. No host root, CAP_SYS_ADMIN, or module parameter change is required since nested VMX, PML, and the TDP MMU are all enabled by default.\\nUI:N - Dirty logging is turned on by the orchestrator or device model automatically (maintenance/rebalancing live migrations, dirty-ring checkpointing, VGA framebuffer tracking) with no human in the loop. Once logging is active the guest\u0027s own L2 execution loses the writes with no cooperation from any other user.\\nS:C - The defect is in the host kernel\u0027s KVM module, but the damage is realized in a different security authority \\u2014 the guest VM\u0027s memory, governed by the guest OS \\u2014 and lets guest activity escape the host hypervisor\u0027s dirty-tracking ABI entirely. A low-privileged guest context causes corruption of guest-kernel and other-guest-process memory it could never write directly, crossing the host/guest boundary.\\nC:H - Every page written by L2 during the logging window is omitted from the dirty bitmap, so the migrated VM retains stale contents for those pages \\u2014 including guest page tables whose rolled-back PTEs still map physical frames since reassigned to other processes or the guest kernel, yielding an arbitrary-read window across intra-guest security boundaries. It also silently defeats any host-side introspection, forensics, or checkpoint mechanism that relies on KVM dirty tracking to observe guest writes.\\nI:H - Writes the guest architecturally committed are silently reverted on the destination VM; for paging structures and kernel data this is a rollback of mapping and permission state, credential structures, reference counts, and lock words, amounting to an arbitrary-write primitive over memory belonging to other processes and the kernel inside the VM. Unlike the emulated-atomic variant of this bug, the entire write stream of L2 is dropped, not a narrow subset.\\nA:H - A VM resuming with inconsistent memory \\u2014 stale page tables or reverted kernel structures \\u2014 panics, hangs, or corrupts its filesystem, taking down the whole VM and every workload on it, and the loss is unrecoverable once the source VM is discarded. Additionally the guest-triggerable KVM_MMU_WARN_ON in clear_dirty_gfn_range()/clear_dirty_pt_masked() (the syzbot-reported symptom) produces a kernel WARN that is fatal on hosts running panic_on_warn.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5982a5392663b30f57ee90b0372c19a7e9cb655a\", \"lessThan\": \"cdf811a937471af2d1facdf8ae80e5e68096f1ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5982a5392663b30f57ee90b0372c19a7e9cb655a\", \"lessThan\": \"e20bff0f1b2de9cfe303dd35ff46470104a87404\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5982a5392663b30f57ee90b0372c19a7e9cb655a\", \"lessThan\": \"2673dfb591a359c75080dd5af3da484b89320d22\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed\"}, {\"url\": \"https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404\"}, {\"url\": \"https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\\n\\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\\naccounts for any role-specific reasons for disabling D-bit dirty logging.\\n\\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\\nwrites made by L2 to not be reflected in the dirty log.\\n\\n[sean: massage shortlog and changelog, tweak ternary op formatting]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:51.630Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26990\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:51.630Z\", \"dateReserved\": \"2024-02-19T14:20:24.205Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:27:48.810Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.