CVE-2024-36953

KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

State: Published
Severity: 4.4 Medium
Published: May 30, 2024
Updated: May 11, 2026
Reserved: May 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully.

Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7d450e2821710718fd6703e9c486249cee913bab to before 4404465a1bee3607ad90a4c5f9e16dfd75b85728Affected 7d450e2821710718fd6703e9c486249cee913bab to before 17db92da8be5dd3bf63c01f4109fe47db64fc66fAffected 7d450e2821710718fd6703e9c486249cee913bab to before 3a5b0378ac6776c7c31b18e0f3c1389bd6005e80Affected 7d450e2821710718fd6703e9c486249cee913bab to before 8d6a1c8e3de36cb0f5e866f1a582b00939e23104Affected 7d450e2821710718fd6703e9c486249cee913bab to before 01981276d64e542c177b243f7c979fee855d5487Affected 7d450e2821710718fd6703e9c486249cee913bab to before 6ddb4f372fc63210034b903d96ebbeb3c7195adbAffected
LinuxLinux	4.7Affected before 4.7Not affected 5.10.217 through 5.10.Not affected 5.15.159 through 5.15.Not affected 6.1.91 through 6.1.Not affected 6.6.31 through 6.6.Not affected 6.8.10 through 6.8.*Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

7d450e2821710718fd6703e9c486249cee913bab to before 4404465a1bee3607ad90a4c5f9e16dfd75b85728Affected
7d450e2821710718fd6703e9c486249cee913bab to before 17db92da8be5dd3bf63c01f4109fe47db64fc66fAffected
7d450e2821710718fd6703e9c486249cee913bab to before 3a5b0378ac6776c7c31b18e0f3c1389bd6005e80Affected
7d450e2821710718fd6703e9c486249cee913bab to before 8d6a1c8e3de36cb0f5e866f1a582b00939e23104Affected
7d450e2821710718fd6703e9c486249cee913bab to before 01981276d64e542c177b243f7c979fee855d5487Affected
7d450e2821710718fd6703e9c486249cee913bab to before 6ddb4f372fc63210034b903d96ebbeb3c7195adbAffected

LinuxLinux

4.7Affected
before 4.7Not affected
5.10.217 through 5.10.*Not affected
5.15.159 through 5.15.*Not affected
6.1.91 through 6.1.*Not affected
6.6.31 through 6.6.*Not affected
6.8.10 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.