CVE-2024-26598

KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

State: Published
Severity: 8.8 High
Published: Feb 23, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes.

Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	6211753fdfd05af9e08f54c8d0ba3ee516034878 to before d04acadb6490aa3314f9c9e087691e55de153b88Affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 to before ba7be666740847d967822bed15500656b26bc703Affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 to before 12c2759ab1343c124ed46ba48f27bd1ef5d2dff4Affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 to before dba788e25f05209adf2b0175eb1691dc89fb1ba6Affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 to before 65b201bf3e9af1b0254243a5881390eda56f72d1Affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 to before dd3956a1b3dd11f46488c928cb890d6937d1ca80Affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 to before ad362fe07fecf0aba839ff2cc59a3617bd42c33fAffected
LinuxLinux	3.11Affected before 3.11Not affected 5.4.269 through 5.4.Not affected 5.10.209 through 5.10.Not affected 5.15.148 through 5.15.Not affected 6.1.75 through 6.1.Not affected 6.6.14 through 6.6.Not affected 6.7.2 through 6.7.Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

6211753fdfd05af9e08f54c8d0ba3ee516034878 to before d04acadb6490aa3314f9c9e087691e55de153b88Affected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to before ba7be666740847d967822bed15500656b26bc703Affected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to before 12c2759ab1343c124ed46ba48f27bd1ef5d2dff4Affected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to before dba788e25f05209adf2b0175eb1691dc89fb1ba6Affected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to before 65b201bf3e9af1b0254243a5881390eda56f72d1Affected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to before dd3956a1b3dd11f46488c928cb890d6937d1ca80Affected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to before ad362fe07fecf0aba839ff2cc59a3617bd42c33fAffected

LinuxLinux

3.11Affected
before 3.11Not affected
5.4.269 through 5.4.*Not affected
5.10.209 through 5.10.*Not affected
5.15.148 through 5.15.*Not affected
6.1.75 through 6.1.*Not affected
6.6.14 through 6.6.*Not affected
6.7.2 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.