Circular Locking Dependency in Linux Kernel: KVM Vulnerability
Summary
DEBIAN-CVE-2024-26691: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix circular locking dependency The rule inside kvm enforces that the vcpu->mutex is taken *inside* kvm->lock. Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports various functionalities, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This particular vulnerability affects the KVM (Kernel-based Virtual Machine) subsystem, which allows the Linux kernel to function as a hypervisor, enabling the creation and management of virtual machines. The vulnerability arises from a circular locking dependency that can lead to deadlocks, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM subsystem, specifically related to the handling of virtual CPU (vcpu) locks. The issue stems from the pkvm_create_hyp_vm() function, which improperly acquires the kvm->lock while already holding the vcpu->mutex lock from kvm_vcpu_ioctl(). This violation of locking rules can lead to a circular locking dependency, resulting in potential deadlocks and system instability. The vulnerability has been assigned the identifier DEBIAN-CVE-2024-26691 and affects versions of the Linux package prior to 6.7.7-1.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package to the fixed version.
Conclusion
The circular locking dependency vulnerability in the KVM subsystem of the Linux kernel poses significant risks to system stability and security. Users are encouraged to update their Linux packages to the patched version 6.7.7-1 to protect against potential deadlocks and ensure the smooth operation of their virtual machines.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a circular locking dependency in the KVM subsystem of the Linux kernel, which can lead to deadlocks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The affected versions are those prior to 6.7.7-1 for both Debian 13 and Debian 14.
Yes, a patch is available in version 6.7.7-1 of the Linux package.
While there are no specific workarounds, it is advisable to monitor the situation and apply the update as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
