CVE-2024-26976

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Always flush async #PF workqueue when vCPU is being destroyed

Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its

completion queue, e.g. when a VM and all its vCPUs is being destroyed.

KVM must ensure that none of its workqueue callbacks is running when the

last reference to the KVM _module_ is put. Gifting a reference to the

associated VM prevents the workqueue callback from dereferencing freed

vCPU/VM memory, but does not prevent the KVM module from being unloaded

before the callback completes.

Drop the misguided VM refcount gifting, as calling kvm_put_kvm() from

async_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will

result in deadlock. async_pf_execute() can't return until kvm_put_kvm()

finishes, and kvm_put_kvm() can't return until async_pf_execute() finishes:

WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm]

Modules linked in: vho

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References