CVE-2024-40953 – This CVE describes a data race condition in the... (How to Fix)

Q: What is the severity of CVE-2024-40953?

CVE-2024-40953 has a CVSS score of 4.7 (MEDIUM). This CVE describes a data race condition in the Linux kernel's KVM subsystem where concurrent access to the 'last_boosted_vcpu' variable could lead to out-of-bounds array indexing. The vulnerability affects systems running KVM virtualization with 257 or more vCPUs, potentially causing kernel crashes or instability.

📋 TL;DR

This CVE describes a data race condition in the Linux kernel's KVM subsystem where concurrent access to the 'last_boosted_vcpu' variable could lead to out-of-bounds array indexing. The vulnerability affects systems running KVM virtualization with 257 or more vCPUs, potentially causing kernel crashes or instability.

💻 Affected Systems

Products:

Linux Kernel with KVM

Versions: Specific affected kernel versions not specified in CVE, but fix commits are provided

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when running KVM virtualization with VMs configured with 257 or more vCPUs. Most production systems use fewer vCPUs per VM.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to out-of-bounds memory access, leading to denial of service for all VMs on the host.

🟠

Likely Case

System instability or kernel crash when running VMs with 257+ vCPUs under high contention scenarios.

🟢

If Mitigated

No impact for systems with fewer than 257 vCPUs per VM or with proper kernel patching.

🌐 Internet-Facing: LOW - This is a kernel-level race condition requiring specific KVM configurations and high vCPU counts.

🏢 Internal Only: MEDIUM - Affects virtualization hosts running many VMs with high vCPU counts in data centers.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific KVM configuration with 257+ vCPUs and race condition timing.

Exploitation requires running VMs with 257+ vCPUs and concurrent access to trigger the race condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits: 11a772d5376aa6d3e2e69b5b5c585f79b60c0e17, 49f683b41f28918df3e51ddc0d928cb2e934ccdb, 4c141136a28421b78f34969b25a4fa32e06e2180, 71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84, 82bd728a06e55f5b5f93d10ce67f4fe7e689853a

Vendor Advisory: https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify kernel version with 'uname -r'.

🔧 Temporary Workarounds

Limit vCPU count per VM

linux

Configure VMs with fewer than 257 vCPUs to avoid triggering the race condition.

virsh edit <vm_name> # Edit vCPU count to < 257
Set <vcpu>256</vcpu> in VM XML configuration

🧯 If You Can't Patch

Ensure no VMs are configured with 257 or more vCPUs
Monitor system logs for KVM-related crashes or instability

🔍 How to Verify

Check if Vulnerable:

Check if running affected kernel version and if any VMs have 257+ vCPUs: 'virsh list --all' and 'virsh vcpuinfo <vm_name>'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version contains fix commits and no VMs have 257+ vCPUs

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KVM error logs in dmesg
System crashes during VM operations

Network Indicators:

Sudden loss of connectivity to VMs
VM migration failures

SIEM Query:

source="kernel" AND ("KVM" OR "last_boosted_vcpu") AND ("panic" OR "crash" OR "BUG")

📊 Metadata

CVE ID: CVE-2024-40953

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

Published: July 12, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-40953, you might also want to check these: