CVE-2024-26691

    Dashboard / Vulnerabilities / CVE-2024-26691

    CVE-2024-26691

    Published: 3 Apr 2024Last Modified: 12 Aug 2026

    Summary: KVM: arm64: Fix circular locking dependency

    Details: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix circular locking dependency The rule inside kvm enforces that the vcpu->mutex is taken *inside* kvm->lock. The rule is violated by the pkvm_create_hyp_vm() which acquires the kvm->lock while already holding the vcpu->mutex lock from kvm_vcpu_ioctl(). Avoid the circular locking dependency altogether by protecting the hyp vm handle with the config_lock, much like we already do for other forms of VM-scoped data.

    References: https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc, https://git.kernel.org/stable/c/3ab1c40a1e915e350d9181a4603af393141970cc, https://git.kernel.org/stable/c/3d16cebf01127f459dcfeb79ed77bd68b124c228, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26691.json, https://nvd.nist.gov/vuln/detail/CVE-2024-26691, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6211753fdfd05af9e08f54c8d0ba3ee516034878
    Fixed -3d16cebf01127f459dcfeb79ed77bd68b124c228

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-26691 | CVE-DB