Riskcovery

CVE-2021-47062

KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs

State
Published
Severity
Not scored
Published
Feb 29, 2024
Updated
May 11, 2026
Reserved
Feb 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs

Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use online_vcpus instead of created_vcpus. This fixes a possible null-pointer dereference as created_vcpus does not guarantee a vCPU exists, since it is updated at the very beginning of KVM_CREATE_VCPU. created_vcpus exists to allow the bulk of vCPU creation to run in parallel, while still correctly restricting the max number of max vCPUs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ad73109ae7ec30d5bfb76be108e304f9f0af4829 to before bd0cced2ae93195668f983d443f7f17e8efd24d2Affected
  • ad73109ae7ec30d5bfb76be108e304f9f0af4829 to before ba7bf5d6336aa9c0d977b161bfa420c56d46ee40Affected
  • ad73109ae7ec30d5bfb76be108e304f9f0af4829 to before c36b16d29f3af5f32fc1b2a3401bf48f71cabee1Affected
LinuxLinux
  • 5.11Affected
  • before 5.11Not affected
  • 5.11.21 through 5.11.*Not affected
  • 5.12.4 through 5.12.*Not affected
  • 5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.