KVM: Always flush async #PF workqueue when vCPU is being destroyed

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2024-26976
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-05-01 06:15:14 UTC
Updated2026-08-04 11:17:30 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs is being destroyed. KVM must ensure that none of its workqueue callbacks is running when the last reference to the KVM _module_ is put. Gifting a reference to the associated VM prevents the workqueue callback from dereferencing freed vCPU/VM memory, but does not prevent the KVM module from being unloaded before the callback completes. Drop the misguided VM refcount gifting, as calling kvm_put_kvm() from async_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will result in deadlock. async_pf_execute() can't return until kvm_put_kvm() finishes, and kvm_put_kvm() can't return until async_pf_execute() finishes: WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm] Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Workqueue: events async_pf_execute [kvm] RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm] Call Trace: <TASK> async_pf_execute+0x198/0x260 [kvm] process_one_work+0x145/0x2d0 worker_thread+0x27e/0x3a0 kthread+0xba/0xe0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 </TASK> ---[ end trace 0000000000000000 ]--- INFO: task kworker/8:1:251 blocked for more than 120 seconds. Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/8:1 state:D stack:0 pid:251 ppid:2 flags:0x00004000 Workqueue: events async_pf_execute [kvm] Call Trace: <TASK> __schedule+0x33f/0xa40 schedule+0x53/0xc0 schedule_timeout+0x12a/0x140 __wait_for_common+0x8d/0x1d0 __flush_work.isra.0+0x19f/0x2c0 kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm] kvm_arch_destroy_vm+0x78/0x1b0 [kvm] kvm_put_kvm+0x1c1/0x320 [kvm] async_pf_execute+0x198/0x260 [kvm] process_one_work+0x145/0x2d0 worker_thread+0x27e/0x3a0 kthread+0xba/0xe0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 </TASK> If kvm_clear_async_pf_completion_queue() actually flushes the workqueue, then there's no need to gift async_pf_execute() a reference because all invocations of async_pf_execute() will be forced to complete before the vCPU and its VM are destroyed/freed. And that in turn fixes the module unloading bug as __fput() won't do module_put() on the last vCPU reference until the vCPU has been freed, e.g. if closing the vCPU file also puts the last reference to the KVM module. Note that kvm_check_async_pf_completion() may also take the work item off the completion queue and so also needs to flush the work queue, as the work will not be seen by kvm_clear_async_pf_completion_queue(). Waiting on the workqueue could theoretically delay a vCPU due to waiting for the work to complete, but that's a very, very small chance, and likely a very small delay. kvm_arch_async_page_present_queued() unconditionally makes a new request, i.e. will effectively delay entering the guest, so the remaining work is really just: trace_kvm_async_pf_completed(addr, cr2_or_gpa); __kvm_vcpu_wake_up(vcpu); mmput(mm); and mmput() can't drop the last reference to the page tables if the vCPU is still alive, i.e. the vCPU won't get stuck tearing down page tables. Add a helper to do the flushing, specifically to deal with "wakeup all" work items, as they aren't actually work items, i.e. are never placed in a workqueue. Trying to flush a bogus workqueue entry rightly makes __flush_work() complain (kudos to whoever added that sanity check). Note, commit 5f6de5cbebee ("KVM: Prevent module exit until al ---truncated---

Risk And Classification

Primary CVSS: v3.1 7 HIGH from ADP

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-400 | CWE-400 CWE-400 Uncontrolled Resource Consumption

VersionSourceTypeScoreSeverityVector
3.1ADPDECLARED7HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary7HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b ab2c2f5d9576112ad22cfd3798071cb74693b1f5 git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b 82e25cc1c2e93c3023da98be282322fc08b61ffb git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b f8730d6335e5f43d09151fca1f0f41922209a264 git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b 83d3c5e309611ef593e2fcb78444fc8ceedf9bac git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b b54478d20375874aeee257744dedfd3e413432ff git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b a75afe480d4349c524d9c659b1a5a544dbc39a98 git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b 4f3a3bce428fb439c66a578adc447afce7b4a750 git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b caa9af2e27c275e089d702cfbaaece3b42bca31b git Not specified
CNA Linux Linux affected af585b921e5d1e919947c4b1164b59507fe7cd7b 3d75b8aa5c29058a512db29da7cbee8052724157 git Not specified
CNA Linux Linux affected 2.6.38 Not specified
CNA Linux Linux unaffected 2.6.38 semver Not specified
CNA Linux Linux unaffected 4.19.312 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.274 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.215 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.154 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.84 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.24 6.6.* semver Not specified
CNA Linux Linux unaffected 6.7.12 6.7.* semver Not specified
CNA Linux Linux unaffected 6.8.3 6.8.* semver Not specified
CNA Linux Linux unaffected 6.9 * original_commit_for_fix Not specified
ADP Linux Linux Kernel affected af585b921e5d ab2c2f5d9576 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d 82e25cc1c2e9 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d 8730d6335e5 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d 83d3c5e30961 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d b54478d20375 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d a75afe480d43 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d 4f3a3bce428f custom Not specified
ADP Linux Linux Kernel affected af585b921e5d caa9af2e27c2 custom Not specified
ADP Linux Linux Kernel affected af585b921e5d 3d75b8aa5c29 custom Not specified
ADP Linux Linux Kernel affected 2.6.38 Not specified
ADP Linux Linux Kernel unaffected 2.6.38 custom Not specified
ADP Linux Linux Kernel unaffected 4.19.312 4.20 custom Not specified
ADP Linux Linux Kernel unaffected 5.4.274 5.5 custom Not specified
ADP Linux Linux Kernel unaffected 5.10.215 5.11 custom Not specified
ADP Linux Linux Kernel unaffected 5.15.154 5.16 custom Not specified
ADP Linux Linux Kernel unaffected 6.1.84 6.2 custom Not specified
ADP Linux Linux Kernel unaffected 6.6.24 6.7 custom Not specified
ADP Linux Linux Kernel unaffected 6.7.12 6.8 custom Not specified
ADP Linux Linux Kernel unaffected 6.8.3 6.9 custom Not specified
ADP Linux Linux Kernel unaffected 6.9 Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00017.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00020.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report