CVE-2024-40953 (GCVE-0-2024-40953)
Vulnerability from cvelistv5
Published
2024-07-12 12:31
Modified
2026-08-05 11:34
Severity ?
7.9 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely scenario the compiler tears the stores, it's theoretically possible for KVM to attempt to get a vCPU using an out-of-bounds index, e.g. if the write is split into multiple 8-bit stores, and is paired with a 32-bit load on a VM with 257 vCPUs: CPU0 CPU1 last_boosted_vcpu = 0xff; (last_boosted_vcpu = 0x100) last_boosted_vcpu[15:8] = 0x01; i = (last_boosted_vcpu = 0x1ff) last_boosted_vcpu[7:0] = 0x00; vcpu = kvm->vcpu_array[0x1ff]; As detected by KCSAN: BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm] write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16: kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4: kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x00000012 -> 0x00000000
References
Impacted products
Vendor Product Version
Linux Linux Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
Version: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:17.097Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40953",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:03:52.034893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:24.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/kvm_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11a772d5376aa6d3e2e69b5b5c585f79b60c0e17",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "4c141136a28421b78f34969b25a4fa32e06e2180",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "82bd728a06e55f5b5f93d10ce67f4fe7e689853a",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "92c77807d938145c7c3350c944ef9f39d7f6017c",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "a937ef951bba72f48d2402451419d725d70dba20",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "95c8dd79f3a14df96b3820b35b8399bd91b2be60",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            },
            {
              "lessThan": "49f683b41f28918df3e51ddc0d928cb2e934ccdb",
              "status": "affected",
              "version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/kvm_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.228",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.228",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.169",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\n\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\nloads and stores are atomic.  In the extremely unlikely scenario the\ncompiler tears the stores, it\u0027s theoretically possible for KVM to attempt\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\n257 vCPUs:\n\n  CPU0                              CPU1\n  last_boosted_vcpu = 0xff;\n\n                                    (last_boosted_vcpu = 0x100)\n                                    last_boosted_vcpu[15:8] = 0x01;\n  i = (last_boosted_vcpu = 0x1ff)\n                                    last_boosted_vcpu[7:0] = 0x00;\n\n  vcpu = kvm-\u003evcpu_array[0x1ff];\n\nAs detected by KCSAN:\n\n  BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\n\n  write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\n  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\n  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\n  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\n\t\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\n  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\n  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\n  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\n  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\n  __x64_sys_ioctl (fs/ioctl.c:890)\n  x64_sys_call (arch/x86/entry/syscall_64.c:33)\n  do_syscall_64 (arch/x86/entry/common.c:?)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n  read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\n  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\n  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\n  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\n\t\t\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\n  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\n  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\n  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\n  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\n  __x64_sys_ioctl (fs/ioctl.c:890)\n  x64_sys_call (arch/x86/entry/syscall_64.c:33)\n  do_syscall_64 (arch/x86/entry/common.c:?)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n  value changed: 0x00000012 -\u003e 0x00000000"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is entered only from guest execution of PAUSE/WFE/DIAG-0x44 handled by the host KVM module, or equivalently via the `KVM_RUN` ioctl on `/dev/kvm` as shown in the KCSAN stack trace. There is no network-facing path to `kvm_vcpu_on_spin()`, so the attacker must be running code locally on the host or inside a VM hosted on it.\nAC:L - The attacker controls both sides of the race outright \u2014 a guest simply runs PAUSE spin loops on several vCPUs at once, driving many threads into the unsynchronized read/write of `kvm-\u003elast_boosted_vcpu` with no external precondition. No specific victim state or memory layout the attacker cannot influence is required to hit the racing accesses.\nPR:L - The attacker needs the ability to run code inside a VM on the host (or open `/dev/kvm` locally), which is an unprivileged-user-level capability \u2014 no root or CAP_SYS_ADMIN is required, and PAUSE is executable from guest ring 3. This matches the standard treatment of guest-triggerable KVM host bugs.\nUI:N - Triggering requires only that the attacker\u0027s own guest vCPU threads spin concurrently; no host administrator or other user has to perform any action. The race is hit entirely by the attacker\u0027s own execution.\nS:C - The bug is triggered by unprivileged code inside a guest but the corrupted index and any resulting wild pointer access occur in the host kernel, crossing the VM-to-hypervisor security boundary. A guest compromising host kernel availability/integrity is a scope change.\nC:L - A torn value yields an out-of-bounds vCPU index, causing the host to read a pointer-sized slot past the vCPU array and then dereference it (`vcpu-\u003eready`, `vcpu-\u003epreempted`, `target-\u003epid`), touching host kernel memory outside the intended object. The read value is never returned to the guest and the offset is not attacker-chosen, so this is a limited disclosure rather than an arbitrary read primitive.\nI:L - `kvm_vcpu_eligible_for_directed_yield()` writes `vcpu-\u003espin_loop.dy_eligible` through the same unvalidated pointer, giving a fixed-offset host-kernel write via an out-of-bounds vCPU reference, and the bogus target also perturbs host scheduling through `yield_to()`. The written value and target address are not attacker-controlled, limiting this to bounded corruption rather than a control-flow hijack primitive.\nA:H - Per the upstream changelog, the torn access lets KVM fetch a vCPU with an out-of-bounds index; the resulting NULL or garbage pointer is dereferenced without any validation, oopsing or panicking the host kernel. A guest crashing the hypervisor takes down the host and every other VM on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:12.855Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c141136a28421b78f34969b25a4fa32e06e2180"
        },
        {
          "url": "https://git.kernel.org/stable/c/71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84"
        },
        {
          "url": "https://git.kernel.org/stable/c/82bd728a06e55f5b5f93d10ce67f4fe7e689853a"
        },
        {
          "url": "https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20"
        },
        {
          "url": "https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60"
        },
        {
          "url": "https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb"
        }
      ],
      "title": "KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40953",
    "datePublished": "2024-07-12T12:31:56.832Z",
    "dateReserved": "2024-07-12T12:17:45.592Z",
    "dateUpdated": "2026-08-05T11:34:12.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:17.097Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40953\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:03:52.034893Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.465Z\"}}], \"cna\": {\"title\": \"KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"4c141136a28421b78f34969b25a4fa32e06e2180\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"82bd728a06e55f5b5f93d10ce67f4fe7e689853a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"92c77807d938145c7c3350c944ef9f39d7f6017c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"a937ef951bba72f48d2402451419d725d70dba20\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"95c8dd79f3a14df96b3820b35b8399bd91b2be60\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"49f683b41f28918df3e51ddc0d928cb2e934ccdb\", \"versionType\": \"git\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.39\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.39\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.228\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.169\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\"}, {\"url\": \"https://git.kernel.org/stable/c/4c141136a28421b78f34969b25a4fa32e06e2180\"}, {\"url\": \"https://git.kernel.org/stable/c/71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\"}, {\"url\": \"https://git.kernel.org/stable/c/82bd728a06e55f5b5f93d10ce67f4fe7e689853a\"}, {\"url\": \"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\"}, {\"url\": \"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\"}, {\"url\": \"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\"}, {\"url\": \"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\\n\\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\\nloads and stores are atomic.  In the extremely unlikely scenario the\\ncompiler tears the stores, it\u0027s theoretically possible for KVM to attempt\\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\\n257 vCPUs:\\n\\n  CPU0                              CPU1\\n  last_boosted_vcpu = 0xff;\\n\\n                                    (last_boosted_vcpu = 0x100)\\n                                    last_boosted_vcpu[15:8] = 0x01;\\n  i = (last_boosted_vcpu = 0x1ff)\\n                                    last_boosted_vcpu[7:0] = 0x00;\\n\\n  vcpu = kvm-\u003evcpu_array[0x1ff];\\n\\nAs detected by KCSAN:\\n\\n  BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\\n\\n  write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\\n  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\\n  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n  __x64_sys_ioctl (fs/ioctl.c:890)\\n  x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n  do_syscall_64 (arch/x86/entry/common.c:?)\\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n  read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\\n  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\\n  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t\\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n  __x64_sys_ioctl (fs/ioctl.c:890)\\n  x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n  do_syscall_64 (arch/x86/entry/common.c:?)\\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n  value changed: 0x00000012 -\u003e 0x00000000\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.228\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.169\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"2.6.39\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:23:01.403Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40953\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:23:01.403Z\", \"dateReserved\": \"2024-07-12T12:17:45.592Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:31:56.832Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.