7.8

CVE-2024-46830: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS

Modified
AliasesUBUNTU-CVE-2024-46830DEBIAN-CVE-2024-46830
Published 27-09-2024Last modified 05-08-2026

Vulnerability summary

CVE-2024-46830 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 28 · Related 26
DLA-4008-1DSA-5782-1SUSE-SU-2024:3569-1SUSE-SU-2024:3587-1SUSE-SU-2024:3592-1SUSE-SU-2024:3984-1

Timeline

  1. 27-09-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS. ============================= WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted ----------------------------- include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 </TASK>

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

16%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.25% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu117 products
  • linux< 5.15.0-173.183 | < 6.8.0-50.51
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1103.110 | < 6.8.0-1020.22
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ e302786233e6bc512986d007c96458ccf5ca21c7, < 5f35099fa3d59caf10bda88b033538e90086684e | ≥ f7e570780efc5cec9b2ed1e0472a7da14e864fdb, < fa297c33faefe51e10244e8a378837fca4963228 | ≥ f7e570780efc5cec9b2ed1e0472a7da14e864fdb, < 939375737b5a0b1bf9b1e75129054e11bc9ca65e | ≥ f7e570780efc5cec9b2ed1e0472a7da14e864fdb, < ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9 | ≥ f7e570780efc5cec9b2ed1e0472a7da14e864fdb, < 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 | 080dbe7e9b86a0392d8dffc00d9971792afc121f | b4c0d89c92e957ecccce12e66b63875d0cc7af7e | ≥ 5.15.19, < 5.15.198 | ≥ 5.10.97, < 5.11 | ≥ 5.16.5, < 5.17 | 5.17
  • linux_kernel≥ 5.10.97, < 5.11 | ≥ 5.15.19, < 5.15.198 | ≥ 5.16.5, < 5.17 | ≥ 5.17.1, < 6.1.110 | ≥ 6.2, < 6.6.51 | ≥ 6.7, < 6.10.10 | 6.11:rc1 | 6.11:rc2 | 6.11:rc3 | 6.11:rc4 | 6.11:rc5 | 6.11:rc6

3 vendors · 121 products

References

25 links
Show all 25 references