{"api_version":"1","generated_at":"2026-08-05T05:17:25+00:00","cve":"CVE-2024-26976","urls":{"html":"https://cve.report/CVE-2024-26976","api":"https://cve.report/api/cve/CVE-2024-26976.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-26976","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-26976"},"summary":{"title":"KVM: Always flush async #PF workqueue when vCPU is being destroyed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Always flush async #PF workqueue when vCPU is being destroyed\n\nAlways flush the per-vCPU async #PF workqueue when a vCPU is clearing its\ncompletion queue, e.g. when a VM and all its vCPUs is being destroyed.\nKVM must ensure that none of its workqueue callbacks is running when the\nlast reference to the KVM _module_ is put.  Gifting a reference to the\nassociated VM prevents the workqueue callback from dereferencing freed\nvCPU/VM memory, but does not prevent the KVM module from being unloaded\nbefore the callback completes.\n\nDrop the misguided VM refcount gifting, as calling kvm_put_kvm() from\nasync_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will\nresult in deadlock.  async_pf_execute() can't return until kvm_put_kvm()\nfinishes, and kvm_put_kvm() can't return until async_pf_execute() finishes:\n\n WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm]\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass\n CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n Workqueue: events async_pf_execute [kvm]\n RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm]\n Call Trace:\n  <TASK>\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  </TASK>\n ---[ end trace 0000000000000000 ]---\n INFO: task kworker/8:1:251 blocked for more than 120 seconds.\n       Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/8:1     state:D stack:0     pid:251   ppid:2      flags:0x00004000\n Workqueue: events async_pf_execute [kvm]\n Call Trace:\n  <TASK>\n  __schedule+0x33f/0xa40\n  schedule+0x53/0xc0\n  schedule_timeout+0x12a/0x140\n  __wait_for_common+0x8d/0x1d0\n  __flush_work.isra.0+0x19f/0x2c0\n  kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm]\n  kvm_arch_destroy_vm+0x78/0x1b0 [kvm]\n  kvm_put_kvm+0x1c1/0x320 [kvm]\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  </TASK>\n\nIf kvm_clear_async_pf_completion_queue() actually flushes the workqueue,\nthen there's no need to gift async_pf_execute() a reference because all\ninvocations of async_pf_execute() will be forced to complete before the\nvCPU and its VM are destroyed/freed.  And that in turn fixes the module\nunloading bug as __fput() won't do module_put() on the last vCPU reference\nuntil the vCPU has been freed, e.g. if closing the vCPU file also puts the\nlast reference to the KVM module.\n\nNote that kvm_check_async_pf_completion() may also take the work item off\nthe completion queue and so also needs to flush the work queue, as the\nwork will not be seen by kvm_clear_async_pf_completion_queue().  Waiting\non the workqueue could theoretically delay a vCPU due to waiting for the\nwork to complete, but that's a very, very small chance, and likely a very\nsmall delay.  kvm_arch_async_page_present_queued() unconditionally makes a\nnew request, i.e. will effectively delay entering the guest, so the\nremaining work is really just:\n\n        trace_kvm_async_pf_completed(addr, cr2_or_gpa);\n\n        __kvm_vcpu_wake_up(vcpu);\n\n        mmput(mm);\n\nand mmput() can't drop the last reference to the page tables if the vCPU is\nstill alive, i.e. the vCPU won't get stuck tearing down page tables.\n\nAdd a helper to do the flushing, specifically to deal with \"wakeup all\"\nwork items, as they aren't actually work items, i.e. are never placed in a\nworkqueue.  Trying to flush a bogus workqueue entry rightly makes\n__flush_work() complain (kudos to whoever added that sanity check).\n\nNote, commit 5f6de5cbebee (\"KVM: Prevent module exit until al\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2024-05-01 06:15:14","updated_at":"2026-08-04 11:17:30"},"problem_types":["CWE-400","CWE-400 CWE-400 Uncontrolled Resource Consumption"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750","name":"https://git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","name":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5","name":"https://git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff","name":"https://git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264","name":"https://git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac","name":"https://git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b","name":"https://git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157","name":"https://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98","name":"https://git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","name":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb","name":"https://git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26976","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26976","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b ab2c2f5d9576112ad22cfd3798071cb74693b1f5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b 82e25cc1c2e93c3023da98be282322fc08b61ffb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b f8730d6335e5f43d09151fca1f0f41922209a264 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b 83d3c5e309611ef593e2fcb78444fc8ceedf9bac git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b b54478d20375874aeee257744dedfd3e413432ff git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b a75afe480d4349c524d9c659b1a5a544dbc39a98 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b 4f3a3bce428fb439c66a578adc447afce7b4a750 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b caa9af2e27c275e089d702cfbaaece3b42bca31b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected af585b921e5d1e919947c4b1164b59507fe7cd7b 3d75b8aa5c29058a512db29da7cbee8052724157 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.38","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.38 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.312 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.274 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.215 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.154 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.84 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.24 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.7.12 6.7.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8.3 6.8.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.9 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d ab2c2f5d9576 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d 82e25cc1c2e9 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d 8730d6335e5 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d 83d3c5e30961 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d b54478d20375 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d a75afe480d43 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d 4f3a3bce428f custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d caa9af2e27c2 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected af585b921e5d 3d75b8aa5c29 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 2.6.38","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 2.6.38 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 4.19.312 4.20 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 5.4.274 5.5 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 5.10.215 5.11 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 5.15.154 5.16 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 6.1.84 6.2 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 6.6.24 6.7 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 6.7.12 6.8 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 6.8.3 6.9 custom","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"unaffected 6.9","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"26976","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"affected":[{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"ab2c2f5d9576","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"82e25cc1c2e9","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"8730d6335e5","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"83d3c5e30961","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"b54478d20375","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"a75afe480d43","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"4f3a3bce428f","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"caa9af2e27c2","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"3d75b8aa5c29","status":"affected","version":"af585b921e5d","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"status":"affected","version":"2.6.38"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"4.20","status":"unaffected","version":"4.19.312","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"5.5","status":"unaffected","version":"5.4.274","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"5.11","status":"unaffected","version":"5.10.215","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"5.16","status":"unaffected","version":"5.15.154","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"6.2","status":"unaffected","version":"6.1.84","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"6.7","status":"unaffected","version":"6.6.24","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"6.8","status":"unaffected","version":"6.7.12","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThanOrEqual":"6.9","status":"unaffected","version":"6.8.3","versionType":"custom"}]},{"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"status":"unaffected","version":"6.9"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2024-26976","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-05T21:06:50.709457Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400 Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-02-05T21:08:04.785Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-02T00:21:05.782Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["virt/kvm/async_pf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ab2c2f5d9576112ad22cfd3798071cb74693b1f5","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"82e25cc1c2e93c3023da98be282322fc08b61ffb","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"f8730d6335e5f43d09151fca1f0f41922209a264","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"83d3c5e309611ef593e2fcb78444fc8ceedf9bac","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"b54478d20375874aeee257744dedfd3e413432ff","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"a75afe480d4349c524d9c659b1a5a544dbc39a98","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"4f3a3bce428fb439c66a578adc447afce7b4a750","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"caa9af2e27c275e089d702cfbaaece3b42bca31b","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"},{"lessThan":"3d75b8aa5c29058a512db29da7cbee8052724157","status":"affected","version":"af585b921e5d1e919947c4b1164b59507fe7cd7b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["virt/kvm/async_pf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.312","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.274","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.215","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.154","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.84","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.24","versionType":"semver"},{"lessThanOrEqual":"6.7.*","status":"unaffected","version":"6.7.12","versionType":"semver"},{"lessThanOrEqual":"6.8.*","status":"unaffected","version":"6.8.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.9","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.312","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.274","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.215","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.154","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.84","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.24","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.12","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.8.3","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9","versionStartIncluding":"2.6.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Always flush async #PF workqueue when vCPU is being destroyed\n\nAlways flush the per-vCPU async #PF workqueue when a vCPU is clearing its\ncompletion queue, e.g. when a VM and all its vCPUs is being destroyed.\nKVM must ensure that none of its workqueue callbacks is running when the\nlast reference to the KVM _module_ is put.  Gifting a reference to the\nassociated VM prevents the workqueue callback from dereferencing freed\nvCPU/VM memory, but does not prevent the KVM module from being unloaded\nbefore the callback completes.\n\nDrop the misguided VM refcount gifting, as calling kvm_put_kvm() from\nasync_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will\nresult in deadlock.  async_pf_execute() can't return until kvm_put_kvm()\nfinishes, and kvm_put_kvm() can't return until async_pf_execute() finishes:\n\n WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm]\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass\n CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n Workqueue: events async_pf_execute [kvm]\n RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm]\n Call Trace:\n  <TASK>\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  </TASK>\n ---[ end trace 0000000000000000 ]---\n INFO: task kworker/8:1:251 blocked for more than 120 seconds.\n       Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/8:1     state:D stack:0     pid:251   ppid:2      flags:0x00004000\n Workqueue: events async_pf_execute [kvm]\n Call Trace:\n  <TASK>\n  __schedule+0x33f/0xa40\n  schedule+0x53/0xc0\n  schedule_timeout+0x12a/0x140\n  __wait_for_common+0x8d/0x1d0\n  __flush_work.isra.0+0x19f/0x2c0\n  kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm]\n  kvm_arch_destroy_vm+0x78/0x1b0 [kvm]\n  kvm_put_kvm+0x1c1/0x320 [kvm]\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  </TASK>\n\nIf kvm_clear_async_pf_completion_queue() actually flushes the workqueue,\nthen there's no need to gift async_pf_execute() a reference because all\ninvocations of async_pf_execute() will be forced to complete before the\nvCPU and its VM are destroyed/freed.  And that in turn fixes the module\nunloading bug as __fput() won't do module_put() on the last vCPU reference\nuntil the vCPU has been freed, e.g. if closing the vCPU file also puts the\nlast reference to the KVM module.\n\nNote that kvm_check_async_pf_completion() may also take the work item off\nthe completion queue and so also needs to flush the work queue, as the\nwork will not be seen by kvm_clear_async_pf_completion_queue().  Waiting\non the workqueue could theoretically delay a vCPU due to waiting for the\nwork to complete, but that's a very, very small chance, and likely a very\nsmall delay.  kvm_arch_async_page_present_queued() unconditionally makes a\nnew request, i.e. will effectively delay entering the guest, so the\nremaining work is really just:\n\n        trace_kvm_async_pf_completed(addr, cr2_or_gpa);\n\n        __kvm_vcpu_wake_up(vcpu);\n\n        mmput(mm);\n\nand mmput() can't drop the last reference to the page tables if the vCPU is\nstill alive, i.e. the vCPU won't get stuck tearing down page tables.\n\nAdd a helper to do the flushing, specifically to deal with \"wakeup all\"\nwork items, as they aren't actually work items, i.e. are never placed in a\nworkqueue.  Trying to flush a bogus workqueue entry rightly makes\n__flush_work() complain (kudos to whoever added that sanity check).\n\nNote, commit 5f6de5cbebee (\"KVM: Prevent module exit until al\n---truncated---"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T09:21:42.760Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5"},{"url":"https://git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb"},{"url":"https://git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264"},{"url":"https://git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac"},{"url":"https://git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff"},{"url":"https://git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98"},{"url":"https://git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750"},{"url":"https://git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b"},{"url":"https://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157"}],"title":"KVM: Always flush async #PF workqueue when vCPU is being destroyed","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-26976","datePublished":"2024-05-01T05:20:24.025Z","dateReserved":"2024-02-19T14:20:24.203Z","dateUpdated":"2026-08-04T09:21:42.760Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-05-01 06:15:14","lastModifiedDate":"2026-08-04 11:17:30","problem_types":["CWE-400","CWE-400 CWE-400 Uncontrolled Resource Consumption"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-05T21:06:50.709457Z","id":"CVE-2024-26976","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.38","versionEndExcluding":"4.19.312","matchCriteriaId":"1D7CB946-0FE3-48B8-BBB0-A43E0D055492"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.274","matchCriteriaId":"F45A0F3C-C16D-49C4-86D6-D021C3D4B834"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.215","matchCriteriaId":"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.154","matchCriteriaId":"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.84","matchCriteriaId":"834D9BD5-42A6-4D74-979E-4D6D93F630FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.24","matchCriteriaId":"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.12","matchCriteriaId":"6BE9771A-BAFD-4624-95F9-58D536540C53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.8.3","matchCriteriaId":"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"26976","Ordinal":"1","Title":"KVM: Always flush async #PF workqueue when vCPU is being destroy","CVE":"CVE-2024-26976","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"26976","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Always flush async #PF workqueue when vCPU is being destroyed\n\nAlways flush the per-vCPU async #PF workqueue when a vCPU is clearing its\ncompletion queue, e.g. when a VM and all its vCPUs is being destroyed.\nKVM must ensure that none of its workqueue callbacks is running when the\nlast reference to the KVM _module_ is put.  Gifting a reference to the\nassociated VM prevents the workqueue callback from dereferencing freed\nvCPU/VM memory, but does not prevent the KVM module from being unloaded\nbefore the callback completes.\n\nDrop the misguided VM refcount gifting, as calling kvm_put_kvm() from\nasync_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will\nresult in deadlock.  async_pf_execute() can't return until kvm_put_kvm()\nfinishes, and kvm_put_kvm() can't return until async_pf_execute() finishes:\n\n WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm]\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass\n CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n Workqueue: events async_pf_execute [kvm]\n RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm]\n Call Trace:\n  <TASK>\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  </TASK>\n ---[ end trace 0000000000000000 ]---\n INFO: task kworker/8:1:251 blocked for more than 120 seconds.\n       Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/8:1     state:D stack:0     pid:251   ppid:2      flags:0x00004000\n Workqueue: events async_pf_execute [kvm]\n Call Trace:\n  <TASK>\n  __schedule+0x33f/0xa40\n  schedule+0x53/0xc0\n  schedule_timeout+0x12a/0x140\n  __wait_for_common+0x8d/0x1d0\n  __flush_work.isra.0+0x19f/0x2c0\n  kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm]\n  kvm_arch_destroy_vm+0x78/0x1b0 [kvm]\n  kvm_put_kvm+0x1c1/0x320 [kvm]\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  </TASK>\n\nIf kvm_clear_async_pf_completion_queue() actually flushes the workqueue,\nthen there's no need to gift async_pf_execute() a reference because all\ninvocations of async_pf_execute() will be forced to complete before the\nvCPU and its VM are destroyed/freed.  And that in turn fixes the module\nunloading bug as __fput() won't do module_put() on the last vCPU reference\nuntil the vCPU has been freed, e.g. if closing the vCPU file also puts the\nlast reference to the KVM module.\n\nNote that kvm_check_async_pf_completion() may also take the work item off\nthe completion queue and so also needs to flush the work queue, as the\nwork will not be seen by kvm_clear_async_pf_completion_queue().  Waiting\non the workqueue could theoretically delay a vCPU due to waiting for the\nwork to complete, but that's a very, very small chance, and likely a very\nsmall delay.  kvm_arch_async_page_present_queued() unconditionally makes a\nnew request, i.e. will effectively delay entering the guest, so the\nremaining work is really just:\n\n        trace_kvm_async_pf_completed(addr, cr2_or_gpa);\n\n        __kvm_vcpu_wake_up(vcpu);\n\n        mmput(mm);\n\nand mmput() can't drop the last reference to the page tables if the vCPU is\nstill alive, i.e. the vCPU won't get stuck tearing down page tables.\n\nAdd a helper to do the flushing, specifically to deal with \"wakeup all\"\nwork items, as they aren't actually work items, i.e. are never placed in a\nworkqueue.  Trying to flush a bogus workqueue entry rightly makes\n__flush_work() complain (kudos to whoever added that sanity check).\n\nNote, commit 5f6de5cbebee (\"KVM: Prevent module exit until al\n---truncated---","Type":"Description","Title":"KVM: Always flush async #PF workqueue when vCPU is being destroy"}]}}}