CVE-2024-26617 (GCVE-0-2024-26617)

Vulnerability from cvelistv5 – Published: 2024-02-29 15:52 – Updated: 2026-08-05 11:26
VLAI
Title
fs/proc/task_mmu: move mmu notification mechanism inside mm lock
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-11 19:04 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 05509adf297924f51e1493aa86f9fcde1433ed80 (git)
Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 4cccb6221cae6d020270606b9e52b1678fc8b71a (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26617",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-11T19:04:06.799235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:14.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.748Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "05509adf297924f51e1493aa86f9fcde1433ed80",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "4cccb6221cae6d020270606b9e52b1678fc8b71a",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: move mmu notification mechanism inside mm lock\n\nMove mmu notification mechanism inside mm lock to prevent race condition\nin other components which depend on it.  The notifier will invalidate\nmemory range.  Depending upon the number of iterations, different memory\nranges would be invalidated.\n\nThe following warning would be removed by this patch:\nWARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734\n\nThere is no behavioural and performance change with this patch when\nthere is no component registered with the mmu notifier.\n\n[akpm@linux-foundation.org: narrow the scope of `range\u0027, per Sean]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the `PAGEMAP_SCAN` ioctl on `/proc/\u003cpid\u003e/pagemap`, which requires local access to issue syscalls on the target machine. There is no network-facing path to `do_pagemap_scan()`.\nAC:L - The attacker controls both sides of the race: the invalidation window is opened purely by setting `PM_SCAN_WP_MATCHING` and can be held open arbitrarily long by pointing the output `vec` buffer at a userfaultfd-backed page so `pagemap_scan_flush_buffer()`\u0027s `copy_to_user()` blocks, while a sibling thread performs the racing `mmu_notifier_register()` (e.g. `KVM_CREATE_VM`). syzbot reproduced it, confirming reliable triggerability.\nPR:L - Any unprivileged user can open `/proc/self/pagemap` (`proc_mem_open` with `PTRACE_MODE_READ` on one\u0027s own task always succeeds) and there is no capability check in `do_pagemap_cmd()`, `do_pagemap_scan()`, or `pagemap_scan_get_args()`. No user namespace or CAP_SYS_ADMIN is needed.\nUI:N - The attacker performs the entire sequence \u2014 ioctl plus concurrent notifier registration \u2014 from its own threads. No victim action is involved.\nS:U - The vulnerable code and the corrupted state (kernel mm/KVM MMU-notifier bookkeeping) are both in the host kernel, the same security authority as the attacking local process. Standard kernel privilege/DoS boundary.\nC:H - Breaking the start/end pairing leaves secondary MMUs holding stale references to old PFNs \u2014 KVM\u0027s own comment in `kvm_change_spte_gfn()` states the shortcut is only safe because the invariant holds, otherwise \"KVM ... hold[s] references to the old PFN.\" Guests and DMA-capable devices (ODP/SVA/HMM) retain mappings to host pages already released and reallocated, enabling disclosure of arbitrary kernel/other-tenant memory.\nI:H - The same stale writable secondary-MMU/DMA mappings permit writes into freed and reused host pages, and the bug directly corrupts KVM\u0027s `mmu_invalidate_in_progress`/`mn_active_invalidate_count` into states the code asserts are impossible. That combination is exploitable memory corruption, not just a bookkeeping glitch.\nA:H - Reachable outcomes include a kernel `BUG_ON(kvm-\u003emmu_invalidate_in_progress \u003c 0)` oops, the `WARN_ON_ONCE` at `kvm_main.c:732` (panic under `panic_on_warn`), an unkillable `TASK_UNINTERRUPTIBLE` hang in `kvm_swap_active_memslots()` holding `slots_lock`, and permanent guest fault livelock via `mmu_invalidate_retry()`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:17.229Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a"
        }
      ],
      "title": "fs/proc/task_mmu: move mmu notification mechanism inside mm lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26617",
    "datePublished": "2024-02-29T15:52:20.028Z",
    "dateReserved": "2024-02-19T14:20:24.131Z",
    "dateUpdated": "2026-08-05T11:26:17.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26617",
      "date": "2026-08-13",
      "epss": "0.00164",
      "percentile": "0.06034"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.3\", \"matchCriteriaId\": \"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/proc/task_mmu: move mmu notification mechanism inside mm lock\\n\\nMove mmu notification mechanism inside mm lock to prevent race condition\\nin other components which depend on it.  The notifier will invalidate\\nmemory range.  Depending upon the number of iterations, different memory\\nranges would be invalidated.\\n\\nThe following warning would be removed by this patch:\\nWARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734\\n\\nThere is no behavioural and performance change with this patch when\\nthere is no component registered with the mmu notifier.\\n\\n[akpm@linux-foundation.org: narrow the scope of `range\u0027, per Sean]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: mover el mecanismo de notificaci\\u00f3n mmu dentro del bloqueo mm Mueva el mecanismo de notificaci\\u00f3n mmu dentro del bloqueo mm para evitar condiciones de ejecuci\\u00f3n en otros componentes que dependen de \\u00e9l. El notificador invalidar\\u00e1 el rango de memoria. Dependiendo del n\\u00famero de iteraciones, se invalidar\\u00edan diferentes rangos de memoria. Este parche eliminar\\u00eda la siguiente advertencia: ADVERTENCIA: CPU: 0 PID: 5067 en arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/ x86/kvm/../../../virt/kvm/kvm_main.c:734 No hay cambios de comportamiento ni de rendimiento con este parche cuando no hay ning\\u00fan componente registrado con el notificador mmu. [akpm@linux-foundation.org: reduzca el alcance del `rango\u0027, seg\\u00fan Sean]\"}]",
      "id": "CVE-2024-26617",
      "lastModified": "2024-12-12T15:34:40.053",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}]}",
      "published": "2024-03-11T18:15:19.457",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26617\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-11T18:15:19.457\",\"lastModified\":\"2026-08-04T11:16:48.807\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/proc/task_mmu: move mmu notification mechanism inside mm lock\\n\\nMove mmu notification mechanism inside mm lock to prevent race condition\\nin other components which depend on it.  The notifier will invalidate\\nmemory range.  Depending upon the number of iterations, different memory\\nranges would be invalidated.\\n\\nThe following warning would be removed by this patch:\\nWARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734\\n\\nThere is no behavioural and performance change with this patch when\\nthere is no component registered with the mmu notifier.\\n\\n[akpm@linux-foundation.org: narrow the scope of `range\u0027, per Sean]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: mover el mecanismo de notificaci\u00f3n mmu dentro del bloqueo mm Mueva el mecanismo de notificaci\u00f3n mmu dentro del bloqueo mm para evitar condiciones de ejecuci\u00f3n en otros componentes que dependen de \u00e9l. El notificador invalidar\u00e1 el rango de memoria. Dependiendo del n\u00famero de iteraciones, se invalidar\u00edan diferentes rangos de memoria. Este parche eliminar\u00eda la siguiente advertencia: ADVERTENCIA: CPU: 0 PID: 5067 en arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/ x86/kvm/../../../virt/kvm/kvm_main.c:734 No hay cambios de comportamiento ni de rendimiento con este parche cuando no hay ning\u00fan componente registrado con el notificador mmu. [akpm@linux-foundation.org: reduzca el alcance del `rango\u0027, seg\u00fan Sean]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/proc/task_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"52526ca7fdb905a768a93f8faa418e9b988fc34b\",\"lessThan\":\"05509adf297924f51e1493aa86f9fcde1433ed80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"52526ca7fdb905a768a93f8faa418e9b988fc34b\",\"lessThan\":\"4cccb6221cae6d020270606b9e52b1678fc8b71a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/proc/task_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.3\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-11T19:04:06.799235Z\",\"id\":\"CVE-2024-26617\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.3\",\"matchCriteriaId\":\"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:58+00:00",
      "cve": "CVE-2024-26617",
      "id": "CVE-2024-26617",
      "initial_release_date": "2024-02-29T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/proc/task_mmu: move mmu notification mechanism inside mm lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26617.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T01:01:47Z",
      "cve": "CVE-2024-26617",
      "id": "CVE-2024-26617",
      "initial_release_date": "2024-03-13T04:22:17Z",
      "product_status:known_not_affected": "292",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26617",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26617.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:07:19.748Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26617\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-11T19:04:06.799235Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:41.661Z\"}}], \"cna\": {\"title\": \"fs/proc/task_mmu: move mmu notification mechanism inside mm lock\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through the `PAGEMAP_SCAN` ioctl on `/proc/\u003cpid\u003e/pagemap`, which requires local access to issue syscalls on the target machine. There is no network-facing path to `do_pagemap_scan()`.\\nAC:L - The attacker controls both sides of the race: the invalidation window is opened purely by setting `PM_SCAN_WP_MATCHING` and can be held open arbitrarily long by pointing the output `vec` buffer at a userfaultfd-backed page so `pagemap_scan_flush_buffer()`\u0027s `copy_to_user()` blocks, while a sibling thread performs the racing `mmu_notifier_register()` (e.g. `KVM_CREATE_VM`). syzbot reproduced it, confirming reliable triggerability.\\nPR:L - Any unprivileged user can open `/proc/self/pagemap` (`proc_mem_open` with `PTRACE_MODE_READ` on one\u0027s own task always succeeds) and there is no capability check in `do_pagemap_cmd()`, `do_pagemap_scan()`, or `pagemap_scan_get_args()`. No user namespace or CAP_SYS_ADMIN is needed.\\nUI:N - The attacker performs the entire sequence \\u2014 ioctl plus concurrent notifier registration \\u2014 from its own threads. No victim action is involved.\\nS:U - The vulnerable code and the corrupted state (kernel mm/KVM MMU-notifier bookkeeping) are both in the host kernel, the same security authority as the attacking local process. Standard kernel privilege/DoS boundary.\\nC:H - Breaking the start/end pairing leaves secondary MMUs holding stale references to old PFNs \\u2014 KVM\u0027s own comment in `kvm_change_spte_gfn()` states the shortcut is only safe because the invariant holds, otherwise \\\"KVM ... hold[s] references to the old PFN.\\\" Guests and DMA-capable devices (ODP/SVA/HMM) retain mappings to host pages already released and reallocated, enabling disclosure of arbitrary kernel/other-tenant memory.\\nI:H - The same stale writable secondary-MMU/DMA mappings permit writes into freed and reused host pages, and the bug directly corrupts KVM\u0027s `mmu_invalidate_in_progress`/`mn_active_invalidate_count` into states the code asserts are impossible. That combination is exploitable memory corruption, not just a bookkeeping glitch.\\nA:H - Reachable outcomes include a kernel `BUG_ON(kvm-\u003emmu_invalidate_in_progress \u003c 0)` oops, the `WARN_ON_ONCE` at `kvm_main.c:732` (panic under `panic_on_warn`), an unkillable `TASK_UNINTERRUPTIBLE` hang in `kvm_swap_active_memslots()` holding `slots_lock`, and permanent guest fault livelock via `mmu_invalidate_retry()`.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"52526ca7fdb905a768a93f8faa418e9b988fc34b\", \"lessThan\": \"05509adf297924f51e1493aa86f9fcde1433ed80\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"52526ca7fdb905a768a93f8faa418e9b988fc34b\", \"lessThan\": \"4cccb6221cae6d020270606b9e52b1678fc8b71a\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/proc/task_mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/proc/task_mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80\"}, {\"url\": \"https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/proc/task_mmu: move mmu notification mechanism inside mm lock\\n\\nMove mmu notification mechanism inside mm lock to prevent race condition\\nin other components which depend on it.  The notifier will invalidate\\nmemory range.  Depending upon the number of iterations, different memory\\nranges would be invalidated.\\n\\nThe following warning would be removed by this patch:\\nWARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734\\n\\nThere is no behavioural and performance change with this patch when\\nthere is no component registered with the mmu notifier.\\n\\n[akpm@linux-foundation.org: narrow the scope of `range\u0027, per Sean]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:17.229Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26617\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:17.229Z\", \"dateReserved\": \"2024-02-19T14:20:24.131Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-29T15:52:20.028Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.