CVE-2024-40989

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40989", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:33.823Z", "dateUpdated": "2026-08-05T11:34:27.078Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:27.078Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\n\nWhen tearing down a redistributor region, make sure we don't have\nany dangling pointer to that region stored in a vcpu."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The entire attack is a sequence of ioctls on /dev/kvm and the resulting VM/vCPU/vgic-device file descriptors (KVM_CREATE_DEVICE, KVM_SET_DEVICE_ATTR, KVM_RUN, KVM_GET_DEVICE_ATTR); no network, adjacent-network, or physical path reaches arch/arm64/kvm/vgic.\nAC:L - No race and no unpredictable state is involved \u2014 the attacker deterministically forces the free (redist region with count < nr_vcpus followed by a failing first KVM_RUN, or MMIO-bus exhaustion via ~1000 ioeventfds to make kvm_io_bus_register_dev return -ENOSPC), then re-inits the vgic and reads GICR_TYPER at will, with unlimited time to groom and spray the reclaimed kmalloc-cg-64 slot.\nPR:L - Creating a VM, a KVM_DEV_TYPE_ARM_VGIC_V3 device and vCPUs requires no capability at all \u2014 only the ability to open /dev/kvm, which is world-accessible (0666 udev rule) or kvm-group on mainstream distros and is exposed to unprivileged app-domain virtualization on Android/AVF.\nUI:N - The attacker performs the region setup, the failing KVM_RUN, the re-init and the GICR_TYPER read entirely within its own process; no victim action, mount, or file open is required.\nS:U - The free is only reachable from the host VMM process, not from guest code, so the attacker and the corrupted host kernel heap are in the same security authority \u2014 this is standard local kernel privilege escalation, not a guest-to-host escape.\nC:H - vgic_mmio_vcpu_rdist_is_last() dereferences a stale pointer into a freed, reclaimed kmalloc-cg-64 object, reading base/count/free_index from whatever heap data now occupies that slot; per kernel scoring guidance a use-after-free read of reclaimed slab memory is treated as High, and the resulting GICR_TYPER_LAST bit forms a repeatable oracle over sprayed heap contents.\nI:H - The bug leaves a permanently dangling kernel heap pointer in vcpu->arch.vgic_cpu.rdreg that survives arbitrary reallocation of that slab object, which is the canonical memory-corruption primitive class; the stale dereference also feeds falsified redistributor topology into GICR_TYPER as seen by the guest and by the migration save/restore stream.\nA:H - Dereferencing freed slab memory produces a KASAN use-after-free splat (fatal under panic_on_warn) and can oops outright if the backing page has been returned to the allocator, and the attacker can re-trigger the GICR_TYPER read arbitrarily often."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/vgic/vgic-init.c", "arch/arm64/kvm/vgic/vgic-mmio-v3.c", "arch/arm64/kvm/vgic/vgic.h"], "versions": [{"version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "68df4fc449fcc24347209e500ce26d5816705a77", "status": "affected", "versionType": "git"}, {"version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "48bb62859d47c5c4197a8c01128d0fa4f46ee58c", "status": "affected", "versionType": "git"}, {"version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "152b4123f21e6aff31cea01158176ad96a999c76", "status": "affected", "versionType": "git"}, {"version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/vgic/vgic-init.c", "arch/arm64/kvm/vgic/vgic-mmio-v3.c", "arch/arm64/kvm/vgic/vgic.h"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.96", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.36", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.9.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"}, {"url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"}, {"url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"}, {"url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"}], "title": "KVM: arm64: Disassociate vcpus from redistributor region on teardown", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:58:53.765Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:54.595799Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.480Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:58:53.765Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:54.595799Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.092Z"}}], "cna": {"title": "KVM: arm64: Disassociate vcpus from redistributor region on teardown", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "68df4fc449fcc24347209e500ce26d5816705a77", "versionType": "git"}, {"status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "48bb62859d47c5c4197a8c01128d0fa4f46ee58c", "versionType": "git"}, {"status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "152b4123f21e6aff31cea01158176ad96a999c76", "versionType": "git"}, {"status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "lessThan": "0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8", "versionType": "git"}], "programFiles": ["arch/arm64/kvm/vgic/vgic-init.c", "arch/arm64/kvm/vgic/vgic-mmio-v3.c", "arch/arm64/kvm/vgic/vgic.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.96", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.36", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.7", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/kvm/vgic/vgic-init.c", "arch/arm64/kvm/vgic/vgic-mmio-v3.c", "arch/arm64/kvm/vgic/vgic.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"}, {"url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"}, {"url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"}, {"url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\n\nWhen tearing down a redistributor region, make sure we don't have\nany dangling pointer to that region stored in a vcpu."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.96", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.36", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.7", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T20:23:43.682Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40989", "state": "PUBLISHED", "dateUpdated": "2026-05-11T20:23:43.682Z", "dateReserved": "2024-07-12T12:17:45.605Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:37:33.823Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kvm/vgic/vgic-init.c", "arch/arm64/kvm/vgic/vgic-mmio-v3.c", "arch/arm64/kvm/vgic/vgic.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68df4fc449fcc24347209e500ce26d5816705a77", "status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "versionType": "git"}, {"lessThan": "48bb62859d47c5c4197a8c01128d0fa4f46ee58c", "status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "versionType": "git"}, {"lessThan": "152b4123f21e6aff31cea01158176ad96a999c76", "status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "versionType": "git"}, {"lessThan": "0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8", "status": "affected", "version": "e5a35635464bc5304674b84ea42615a3fd0bd949", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kvm/vgic/vgic-init.c", "arch/arm64/kvm/vgic/vgic-mmio-v3.c", "arch/arm64/kvm/vgic/vgic.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.96", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.36", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4DAC77B7-CD9E-495B-8980-9EA73DE7EBA4", "versionEndExcluding": "6.1.96", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1046C95-860A-45B0-B718-2B29F65BFF10", "versionEndExcluding": "6.6.36", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C", "versionEndExcluding": "6.9.7", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\n\nWhen tearing down a redistributor region, make sure we don't have\nany dangling pointer to that region stored in a vcpu."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: KVM: arm64: desasociar vcpus de la regi\u00f3n del redistribuidor al desmantelar Al desmantelar una regi\u00f3n de redistribuidor, aseg\u00farese de que no tengamos ning\u00fan puntero colgante a esa regi\u00f3n almacenado en una vcpu."}], "id": "CVE-2024-40989", "lastModified": "2026-08-04T11:19:13.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40989", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:01:54.595799Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:20.310", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:7001", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:7000", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.22.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:11482", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.97.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-12-19T00:00:00Z"}, {"advisory": "RHSA-2024:11483", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.97.1.rt14.382.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-12-19T00:00:00Z"}, {"advisory": "RHSA-2024:11313", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.49.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-18T00:00:00Z"}], "bugzilla": {"description": "kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown", "id": "2297573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297573"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H", "status": "verified"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\nWhen tearing down a redistributor region, make sure we don't have\nany dangling pointer to that region stored in a vcpu.", "A vulnerability was found in the Linux kernel's KVM for ARM64 within the vgic-init.c, vgic-mmio-v3.c, and vgic.h files. The virtual vCPUs may retain dangling pointers in a redistributor region after they have been torn down, leading to potential memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40989", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40989\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40989\nhttps://lore.kernel.org/linux-cve-announce/2024071249-CVE-2024-40989-c8da@gregkh/T"], "threat_severity": "Moderate"}

{}