⌘ + K

UBUNTU-CVE-2024-26691

Dashboard / Vulnerabilities / UBUNTU-CVE-2024-26691

UBUNTU-CVE-2024-26691

Published: 3 Apr 2024Last Modified: 8 Oct 2026

Upstream:

Aliases:

Summary:

Details: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix circular locking dependency The rule inside kvm enforces that the vcpu->mutex is taken *inside* kvm->lock. The rule is violated by the pkvm_create_hyp_vm() which acquires the kvm->lock while already holding the vcpu->mutex lock from kvm_vcpu_ioctl(). Avoid the circular locking dependency altogether by protecting the hyp vm handle with the config_lock, much like we already do for other forms of VM-scoped data.

References: https://ubuntu.com/security/CVE-2024-26691, https://git.kernel.org/linus/10c02aad111df02088d1a81792a709f6a7eca6cc, https://git.kernel.org/stable/c/3d16cebf01127f459dcfeb79ed77bd68b124c228, https://git.kernel.org/stable/c/3ab1c40a1e915e350d9181a4603af393141970cc, https://git.kernel.org/stable/c/10c02aad111df02088d1a81792a709f6a7eca6cc, https://www.cve.org/CVERecord?id=CVE-2024-26691, https://ubuntu.com/security/notices/USN-6895-1, https://ubuntu.com/security/notices/USN-6895-2, https://ubuntu.com/security/notices/USN-6900-1, https://ubuntu.com/security/notices/USN-6895-3, https://ubuntu.com/security/notices/USN-6895-4

Affected packages

Package

Name: linux

Purl: pkg:deb/ubuntu/linux?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -None

Affected versions

3.11.0-12.19

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High