{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26990", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.205Z", "datePublished": "2024-05-01T05:27:48.810Z", "dateUpdated": "2026-08-05T11:28:51.630Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:51.630Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status\n\nCheck kvm_mmu_page_ad_need_write_protect() when deciding whether to\nwrite-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU\naccounts for any role-specific reasons for disabling D-bit dirty logging.\n\nSpecifically, TDP MMU SPTEs must be write-protected when the TDP MMU is\nbeing used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled.\nKVM always disables PML when running L2, even when L1 and L2 GPAs are in\nthe some domain, so failing to write-protect TDP MMU SPTEs will cause\nwrites made by L2 to not be reflected in the dirty log.\n\n[sean: massage shortlog and changelog, tweak ternary op formatting]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Triggering the flaw requires executing code in a VM on the affected host — VMLAUNCHing an L2 with EPT disabled via /dev/kvm — which is local code execution on the vulnerable component. No host-side network protocol handler reaches the TDP MMU dirty-logging paths.\nAC:L - The miss is unconditional and deterministic: any SPTE created under the guest_mode TDP root is WRPROT_ONLY, and the clearing path always chose the D-bit instead, with no race, timing window, or memory layout the attacker cannot influence. The guest chooses to run an L2 without EPT and can keep it running indefinitely, and dirty logging is a routine, recurring host operation (migration, dirty ring, framebuffer); syzkaller reproduced it from an ordinary local process.\nPR:L - The attacker only needs the ability to create and run a VM — /dev/kvm access via the kvm group, or simply being the tenant of a guest on a virtualization host — which is a low-privileged position on the vulnerable component. No host root, CAP_SYS_ADMIN, or module parameter change is required since nested VMX, PML, and the TDP MMU are all enabled by default.\nUI:N - Dirty logging is turned on by the orchestrator or device model automatically (maintenance/rebalancing live migrations, dirty-ring checkpointing, VGA framebuffer tracking) with no human in the loop. Once logging is active the guest's own L2 execution loses the writes with no cooperation from any other user.\nS:C - The defect is in the host kernel's KVM module, but the damage is realized in a different security authority — the guest VM's memory, governed by the guest OS — and lets guest activity escape the host hypervisor's dirty-tracking ABI entirely. A low-privileged guest context causes corruption of guest-kernel and other-guest-process memory it could never write directly, crossing the host/guest boundary.\nC:H - Every page written by L2 during the logging window is omitted from the dirty bitmap, so the migrated VM retains stale contents for those pages — including guest page tables whose rolled-back PTEs still map physical frames since reassigned to other processes or the guest kernel, yielding an arbitrary-read window across intra-guest security boundaries. It also silently defeats any host-side introspection, forensics, or checkpoint mechanism that relies on KVM dirty tracking to observe guest writes.\nI:H - Writes the guest architecturally committed are silently reverted on the destination VM; for paging structures and kernel data this is a rollback of mapping and permission state, credential structures, reference counts, and lock words, amounting to an arbitrary-write primitive over memory belonging to other processes and the kernel inside the VM. Unlike the emulated-atomic variant of this bug, the entire write stream of L2 is dropped, not a narrow subset.\nA:H - A VM resuming with inconsistent memory — stale page tables or reverted kernel structures — panics, hangs, or corrupts its filesystem, taking down the whole VM and every workload on it, and the loss is unrecoverable once the source VM is discarded. Additionally the guest-triggerable KVM_MMU_WARN_ON in clear_dirty_gfn_range()/clear_dirty_pt_masked() (the syzbot-reported symptom) produces a kernel WARN that is fatal on hosts running panic_on_warn." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/mmu/tdp_mmu.c" ], "versions": [ { "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a", "lessThan": "cdf811a937471af2d1facdf8ae80e5e68096f1ed", "status": "affected", "versionType": "git" }, { "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a", "lessThan": "e20bff0f1b2de9cfe303dd35ff46470104a87404", "status": "affected", "versionType": "git" }, { "version": "5982a5392663b30f57ee90b0372c19a7e9cb655a", "lessThan": "2673dfb591a359c75080dd5af3da484b89320d22", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/mmu/tdp_mmu.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.8", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed" }, { "url": "https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404" }, { "url": "https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22" } ], "title": "KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-14T20:04:24.835393Z", "id": "CVE-2024-26990", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T20:04:34.681Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/cdf811a937471af2d1facdf8ae80e5e68096f1ed", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e20bff0f1b2de9cfe303dd35ff46470104a87404", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2673dfb591a359c75080dd5af3da484b89320d22", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:15:35.930Z" } } ] } }