CVE-2024-26976 – This vulnerability in the Linux kernel's KVM su... (How to Fix)

Q: What is the severity of CVE-2024-26976?

CVE-2024-26976 has a CVSS score of 7.0 (HIGH). This vulnerability in the Linux kernel's KVM subsystem could allow an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code by triggering a deadlock during virtual machine destruction. It affects systems running KVM virtualization with async page fault handling enabled. The issue occurs when a vCPU is destroyed while async #PF workqueue callbacks are still running.

📋 TL;DR

This vulnerability in the Linux kernel's KVM subsystem could allow an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code by triggering a deadlock during virtual machine destruction. It affects systems running KVM virtualization with async page fault handling enabled. The issue occurs when a vCPU is destroyed while async #PF workqueue callbacks are still running.

💻 Affected Systems

Products:

Linux kernel KVM subsystem

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with KVM support

Default Config Vulnerable: ⚠️ Yes

Notes: Requires KVM virtualization with async page fault handling enabled (default in most KVM configurations).

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash leading to complete denial-of-service, with potential for privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability, VM crashes, or host kernel hangs when destroying virtual machines with active async page faults.

🟢

If Mitigated

Minor performance impact from proper workqueue flushing during VM teardown.

🌐 Internet-Facing: LOW - Requires access to KVM virtualization capabilities, typically not exposed directly to internet.

🏢 Internal Only: MEDIUM - Affects virtualization hosts; malicious VM users or administrators could trigger the condition.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to create/destroy VMs or influence async page fault handling within a VM.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 3d75b8aa5c29, 4f3a3bce428f, 82e25cc1c2e9, 83d3c5e30961, or a75afe480d43

Vendor Advisory: https://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable async page faults

linux

Disable KVM async page fault handling to avoid the vulnerable code path

echo 0 > /sys/module/kvm/parameters/async_pf

🧯 If You Can't Patch

Restrict KVM access to trusted administrators only
Monitor for VM destruction events and system hangs

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if KVM async page faults are enabled: cat /sys/module/kvm/parameters/async_pf

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and test VM destruction with active workloads

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Workqueue deadlock warnings in dmesg
VM destruction failures

Network Indicators:

Sudden loss of VM connectivity

SIEM Query:

source="kernel" AND ("async_pf_execute" OR "kvm_put_kvm" OR "deadlock")

📊 Metadata

CVE ID: CVE-2024-26976

CVSS v3 Score: 7.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-400

Published: May 1, 2024

Last Updated: April 8, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26976, you might also want to check these: